soc_analyst

>_Bilal
Mahmud

Aspiring SOC Analyst defending enterprises against evolving threats — triaging alerts, hunting adversaries through logs, and turning telemetry into decisive incident response.

./contact --init scroll ↓

status: available for engagements

Defending Systems,
responsibly.

Passionate about defending organisations against adversaries through threat monitoring, incident response, and security analysis — focused on identifying and containing risks before they cause harm.

About

//Security-first thinking, intelligence-driven defence.

An aspiring SOC Analyst with four years supporting enterprise Windows and macOS environments, now specialising in threat detection and incident response. I triage alerts, analyse logs, and escalate using SIEM and EDR workflows mapped to MITRE ATT&CK — with strong SLA-driven ticketing discipline.

Comfortable with Microsoft Defender for Endpoint, Event Viewer, O365 / Azure sign-in logs, Wireshark, and KQL / SPL basics. I isolate endpoints, collect evidence, and write clear incident reports — bringing a service-desk mindset to reduce false positives and improve MTTD / MTTR across the SOC.

Years IT Experience

Certifications

20+

Incidents Triaged

MITRE

ATT&CK Aligned

Experience

//Where I've worked & what I've built.

Sep 2025 – Dec 2025

Cyber Security Practitioner

CAPSLOCK · Remote

Completed CIISec/CREST-accredited SOC bootcamp covering incident response, GRC, forensics, and offensive security.
Built and tuned SIEM detections in Microsoft Sentinel and Splunk; investigated alerts via KQL/SPL and mapped findings to MITRE ATT&CK.
Led incident handling end-to-end: triage, containment, evidence collection, MTTD/MTTR improvement.
Practiced vulnerability assessment, remediation, and ISO 27001 / SOC 2 alignment.

Sep 2021 – Sep 2025

IT Technician

Harris Federation · London

Monitored and triaged SIEM/EDR alerts, correlating Windows / O365 / Azure data; managed tickets in ITSM Halo with MITRE ATT&CK playbooks.
Drove SLA-based incident handling: classified severity, contained endpoints via isolation/quarantine, coordinated with L3 and engineering.
Performed root-cause analysis on recurring incidents and produced corrective actions and workarounds.
Tuned detection rules to reduce false positives and improve overall SOC signal quality.

Nov 2017 – Aug 2020

Customer Advisor

Argos · London

Front-line support across phone and in-person channels; resolved escalations within SLA targets.
Reconciled shortages and discrepancies with suppliers, producing audit-ready documentation.

Tools I use