Junya

Profile

Security analyst and software developer. I run SOC work end to end in a lab I built: running ATT&CK techniques, collecting telemetry with Sysmon and Wazuh, writing detections where the defaults miss, and triaging alerts to a verdict. I also ship production software, so I understand how the systems I’m defending are built. Open to cybersecurity analyst and security engineering roles.

Security projects

Lookout — home SOC lab & AI-assisted triage console Oct 2026 · GitHub · live demo

• Built an isolated lab: Wazuh 4.14.8 on Ubuntu; Windows 11 endpoint with Sysmon, the Wazuh agent and Atomic Red Team.
• Ran 8 ATT&CK techniques across 6 tactics; found the default ruleset caught 4 of 8, including a silent miss on LSASS credential dumping.
• Traced the LSASS miss to a telemetry gap, enabled Sysmon ProcessAccess, and wrote 5 custom Wazuh rules mapped to ATT&CK; documented the false positives they produce.
• Built a Next.js triage console (alert queue, process trees, cases, coverage map) with 8 AI features, each schema-validated and human-verified, with prompt-injection defences and rate limiting.
• Wrote 3 incident reports (credential access, encoded PowerShell, persistence) with timeline, evidence, verdict and response.

SIGNAL — self-hosted mini SIEM & detection console Oct 2026 · GitHub

• Ingests Linux auth, Windows Security and Sysmon (EVTX and JSON), nginx/Apache and Wazuh logs by upload, API or a live log shipper; unparsable lines are kept with the reason.
• Wrote 16 Sigma-inspired detection rules (match, threshold, sequence, first-seen) mapped to MITRE ATT&CK v20.0, each with a positive and a negative test; IDs are validated against official ATT&CK data in CI.
• Correlates alerts sharing a host, user or IP into scored incidents with an ATT&CK storyline, a hunt query language, entity graph and exportable incident reports.
• Hardened the console itself: Argon2id, CSRF, server-side roles, CSP, sanitised log rendering and injection-safe search. 247 backend and 32 front-end tests plus an end-to-end test.

PhishGuard — client-side phishing analyser Jun 2026 · GitHub

• Checks SPF, DKIM and DMARC, sender mismatch, URL risk and typosquats (24 brand checks, 13 scoring rules) and exports a PDF report, with no data leaving the browser.

Experience

Freelance developer — junyamade 2026 – present · development portfolio

• Sole developer of Be Whole Care, a live practice platform: session auth + Google OAuth, CSRF protection, rate limiting, role separation, verified payment webhooks (PayFast, Peach) and POPIA-minded audit logging.
• Enforced booking integrity with a database constraint, so double-booking is impossible even under concurrent requests.
• Built K53 Academy (a TypeScript PWA with accounts and progress tracking) and an AI follow-up automation dashboard.
• Shipped sites for South African businesses, including DOOM IT (doomit.co.za), with domain, DNS and SSL setup.

Education & training

• Network Systems — Boston City Campus · in progress
• CompTIA Security+ (SY0-701) — in progress
• TryHackMe SOC Level 1 path — in progress

Skills

Security operations

Alert triage · Log analysis · MITRE ATT&CK mapping · True / false positive verdicts · Incident write-ups · Phishing analysis (SPF · DKIM · DMARC)

Detection & lab

Wazuh 4.14 (SIEM) · Sysmon + sysmon-modular · Custom Wazuh rules (XML) · Sigma-style detection rules · Atomic Red Team · Windows event logs · EVTX · Ubuntu server · UTM VMs

Secure engineering

Input validation (zod) · CSP · HSTS · security headers · Auth, CSRF & rate limiting · Webhook signature checks · Secret scanning (gitleaks) · Prompt-injection defences

Languages & tools

TypeScript · JavaScript · Python · SQL · Postgres · Java · Next.js · React · Git · GitHub Actions CI