Sumit Saini Aspiring SOC Analyst
Turning alerts
into answers.
Cybersecurity & AI student. Building, investigating and documenting the work behind the alert.
Open to SOC & cybersecurity opportunities01SELECTED WORK
Built. Tested. Documented.
02BEHIND THE WORK
Curious by nature. Defensive by choice.
I’m Sumit, a Cybersecurity & AI student building practical skills for a SOC L1 role.
BCA · Cyber Security & AITeerthanker Mahaveer University2024–2027
03CAPABILITIES
The analyst toolkit.
Growing every day.
Monitoring & detectionSplunk · alert triage
- SIEM monitoring
- Alert triage
- Log analysis
- Security event correlation
InvestigationPhishing · endpoint evidence
- IOC & phishing analysis
- Endpoint investigation
- Windows event investigation
- Network traffic analysis
Incident handlingVerdicts · clear handoffs
- TP / FP / BP assessment
- Incident documentation
- Evidence-based escalation
- Containment recommendations
NetworkingTCP/IP · DNS · subnetting
- TCP/IP & subnetting
- DNS
- HTTP / HTTPS
- Ports & protocols
SystemsWindows · Linux · virtual labs
- Windows
- Linux
- Kali Linux
- Virtual machine labs
Scripting & dataPython · SQL fundamentals
- Python
- SQL fundamentals
- Basic automation
- Structured investigation notes
Tools & hands-on exposure
SIEM & monitoring
SplunkLab experience
WazuhLearning
Microsoft SentinelLearning
Endpoint security
SysmonHands-on
Windows Event ViewerHands-on
CrowdStrike / EDR conceptsLearning
Network analysis
WiresharkHands-on
NmapHands-on
NiktoLab experience
IOC investigation
VirusTotalFamiliar
WHOISFamiliar
URL & domain analysisLab experience
Systems & labs
Windows / LinuxHands-on
Kali LinuxHands-on
VMware / TryHackMeLab experience
Development
PythonHands-on
Git / GitHubHands-on
SQLLearning
Exposure reflects personal projects and labs.
04EXPERIENCE
Learning through doing.
2 monthsJuly–August 2026
Skillfied Mentor
Cybersecurity Intern
Python security utilities, defensive exercises and clear technical reports.
My work here
- Built Python-based security utilities and completed guided defensive-security exercises using Kali Linux.
- Documented commands, findings and task outcomes in structured reports.
3 months
Alfido Tech
Cybersecurity Intern
Network-security tasks, threat analysis and a Windows / Kali lab foundation.
My work here
- Completed assigned modules and practical tasks in network security, threat analysis and incident-response fundamentals.
- Developed a lab foundation using Windows 11, Kali Linux, Metasploitable and Sysmon telemetry.
Additional training 2 completed job simulations
Cybersecurity Job Simulation
Phishing analysis · Security awareness
June 2026 · Job simulationCyber Job Simulation
Log review · Cyber investigation
March 2026 · Job simulationPractical simulations, separate from employment.
05METHOD
From signal to a clear handoff.
01Validate02Investigate03Document
Explore my investigation process 10 stages
STAGE 01 / 10
Alert triggered
Read the detection rule, severity and trigger. Record event time and timezone before building a theory.
“What actually caused the detection?”
Alert ID · rule · event time
Read the detection rule, severity and trigger. Record event time and timezone before building a theory.
“What actually caused the detection?”Alert ID · rule · event time
Check whether the raw events satisfy the rule. Compare the user, asset and activity with the available baseline.
“Does the evidence match the alert?”Raw trigger · baseline · log coverage
Read the original records, preserve event references and arrange the relevant activity chronologically.
“Which observations support or contradict my hypothesis?”Evidence references · correlated timeline
Pivot across authentication, identity and endpoint context. Correlate logon type, privilege, device and session.
“Do these events belong to the same activity?”Identity · endpoint · source IP
Use reputation and enrichment as supporting context. An unknown or clean reputation does not establish safety.
“What does enrichment add, and what can’t it prove?”Lookup source · result · time
Search related users, hosts and indicators over a defined time range. Separate confirmed scope from missing coverage.
“What is affected, and what remains unknown?”Time window · affected entities · gaps
Choose true positive, false positive, benign positive or needs more investigation. Explain confidence and contradictions.
“Can another analyst follow the reasoning?”Verdict · confidence · evidence
Propose proportionate next actions under the playbook. Keep recommended containment separate from actions actually taken.
“What should happen next, and who is authorized?”Action status · recommendation · owner
Summarize context, sources, scope, verdict and action status. Make the handoff repeatable with precise evidence references.
“Could someone reproduce this investigation?”Case notes · references · next step
Escalate possible compromise, privileged account impact, spread or material uncertainty. State the risk and exact help needed.
“What decision requires the next response tier?”Escalation reason · impact · request
06TRY AN INVESTIGATION
Your turn. Follow the evidence.
Investigate a suspicious login 4 failures → 1 success
HIGH Authentication anomaly
Failed logins followed by a successful login
2026-09-01 · 22:14:00–22:16:00 UTC · Synthetic Windows Security logs
- User
- admin
- Host
- WIN-USER-01
- Source IP
- 203.0.113.42
- Observed events
- 4 failures → 1 success
Authentication events
0 bookmarkedSame source, user and host. Select a bookmark to preserve a record.
Time / UTCEventResultEvidence bookmark
22:14:03AUTH-014625Type 10Failed
22:14:08AUTH-024625Type 10Failed
22:14:15AUTH-034625Type 10Failed
22:14:22AUTH-044625Type 10Failed
22:15:01AUTH-054624Type 10Success
Inspect full event fields5 synthetic records
Every record below is sample evidence for this demonstration.
EvidenceRef: AUTH-01 TimeCreated: 2026-09-01T22:14:03Z EventID: 4625 Computer: WIN-USER-01 TargetUserName: admin IpAddress: 203.0.113.42 DestinationAddress: 192.0.2.10 LogonType: 10 (RemoteInteractive) Outcome: Failed Detail: Bad password · Logon type 10
EvidenceRef: AUTH-02 TimeCreated: 2026-09-01T22:14:08Z EventID: 4625 Computer: WIN-USER-01 TargetUserName: admin IpAddress: 203.0.113.42 DestinationAddress: 192.0.2.10 LogonType: 10 (RemoteInteractive) Outcome: Failed Detail: Bad password · Logon type 10
EvidenceRef: AUTH-03 TimeCreated: 2026-09-01T22:14:15Z EventID: 4625 Computer: WIN-USER-01 TargetUserName: admin IpAddress: 203.0.113.42 DestinationAddress: 192.0.2.10 LogonType: 10 (RemoteInteractive) Outcome: Failed Detail: Bad password · Logon type 10
EvidenceRef: AUTH-04 TimeCreated: 2026-09-01T22:14:22Z EventID: 4625 Computer: WIN-USER-01 TargetUserName: admin IpAddress: 203.0.113.42 DestinationAddress: 192.0.2.10 LogonType: 10 (RemoteInteractive) Outcome: Failed Detail: Bad password · Logon type 10
EvidenceRef: AUTH-05 TimeCreated: 2026-09-01T22:15:01Z EventID: 4624 Computer: WIN-USER-01 TargetUserName: admin IpAddress: 203.0.113.42 DestinationAddress: 192.0.2.10 LogonType: 10 (RemoteInteractive) Outcome: Success Detail: Remote interactive logon · Type 10
A successful login is an observation. Who performed it and whether it was authorized remain open questions.
Entirely synthetic. No real incident, live lookup, containment or production-system access.
RESUME / PDF
RESUME
The essentials. One page.
07CONTACT
Let’s talk security.
Open to SOC L1 roles and cybersecurity internships.
Based in India · Open to opportunities