Security operations
- Alert triage
- Log analysis
- MITRE ATT&CK mapping
- True / false positive verdicts
- Incident write-ups
- Phishing analysis (SPF · DKIM · DMARC)
Open to cybersecurity & developer roles
I build IT. Then I secure IT. Software developer.
- Johannesburg · open to remote
- Everything here is live & on GitHub
- Replies within 24h
0ATT&CK techniques run
0caught by default rules
0custom detections written
0incident write-ups
Flagship project
Lookout — a home SOC, triaged for real.
- Lab Wazuh, Sysmon and Atomic Red Team on isolated VMs.
- Finding Default rules caught 4 of 8 attacks — and missed credential dumping.
- Fix Five custom detections and a triage console I built.
Latest project
SIGNAL — a SIEM, built from the ground up.
- Ingest Windows Security, Sysmon, Linux auth, web and Wazuh logs.
- Detect 16 ATT&CK-mapped rules, each with a positive and a negative test.
- Correlate Related alerts become one scored incident with an ATT&CK storyline.
The finding
What the defaults missed.
| Technique | What it is | Default Wazuh | My rule |
|---|---|---|---|
T1033 | System owner / user discoveryDiscovery | Missed | 100020 |
T1059.001 | Encoded PowerShellExecution | Caught | not needed |
T1547.001 | Registry Run keyPersistence | Missed | 100030 |
T1053.005 | Scheduled taskPersistence | Partial | 100050 |
T1136.001 | Create local accountPersistence | Caught | not needed |
T1003.001 | LSASS memory dumpCredential access | Missed | 100010 |
T1070.004 | File deletionDefense evasion | Caught | not needed |
T1560.001 | Archive for exfil (makecab)Collection | Missed | 100040 |
What I do
I defend systems — and I build them.
Skills
Tools I use.
Detection & lab
- Wazuh 4.14 (SIEM)
- Sysmon + sysmon-modular
- Custom Wazuh rules (XML)
- Sigma-style detection rules
- Atomic Red Team
- Windows event logs · EVTX
- Ubuntu server · UTM VMs
Secure engineering
- Input validation (zod)
- CSP · HSTS · security headers
- Auth, CSRF & rate limiting
- Webhook signature checks
- Secret scanning (gitleaks)
- Prompt-injection defences
Languages & tools
- TypeScript · JavaScript
- Python
- SQL · Postgres
- Java
- Next.js · React
- Git · GitHub Actions CI
Journey
From building to securing.
2026
Shipped production software
Client systems with logins, payments and personal data.
Jun 2026
Built PhishGuard
A client-side phishing analyser.
2026
Network Systems + Security+
Boston City Campus · Security+ and TryHackMe SOC in progress.
Oct 2026
Built Lookout
A home SOC lab with custom detections and triage.
Oct 2026
Built SIGNAL
A self-hosted mini SIEM with ATT&CK-mapped detections and incident correlation.
Next
Joining a security team
Johannesburg or remote.
References
What clients say.
Ntombi Mothoagae
Be Whole Care · Counselling
He rebuilt our whole practice into one system — clients book and pay themselves now, and I run everything from one screen. I stopped chasing payments completely.
Mfundo Mayisa
DOOM IT · DJ & events
My booking site is live on my own .co.za domain and it looks exactly like my brand. Enquiries come straight to my phone — bookings got easier immediately.
BN Dreamlight
Solar · water · electrical
Our services and prices are laid out clearly and quote requests come straight to WhatsApp. The site makes us look as professional as we actually are.
Tshepo M.
Small business owner
Fast, and he explains things without the jargon. Took a bit longer than I expected because I was slow sending photos, but the result speaks for itself.