// cybersecurity × cloud security — new york
> SIEM detection engineering▮
I find the signal in the noise — hunting simulated threats in SIEM data, hardening a hybrid AD environment, and securing AWS & Azure workloads in a lab I designed, built, and operate end to end.
I didn't wait for permission to do this work — I built my own SOC and run it every day.
// the thesis
Plenty of portfolios describe what someone would do with real infrastructure. I gave myself the access. My homelab is a production-grade virtualization platform running twenty-plus workloads with real users and real uptime expectations — and beside it, an isolated attack-and-defend range where I emulate adversaries, catch them in the SIEM, and write up every finding like an incident report.
This site is organized the way I think about defense — as layers. Foundation: the infrastructure I built and run. Detection: the attacks I simulate and catch. Cloud: where I'm taking it, because the perimeter has moved from the firewall to identity. Everything I claim, I can demo.
Before anyone lets you defend their infrastructure, prove you can run your own. This platform serves real users daily — DNS filtering for every device, TLS on every service, deduplicated backups with enforced retention, zero exposed ports. When something breaks at 2am, I'm the one who fixes it.
Ryzen 9 · 64 GB — 20+ VMs & LXC containers on LVM-thin storage, operated like a small datacenter.
Network-wide DNS filtering and local resolution — every device's queries pass through it.
Nginx Proxy Manager terminating SSL for every internal service with header inspection.
Deduplicated, scheduled backups to a RAID-1 array with enforced retention (3/7/4/1) and weekly GC.
Zero-config WireGuard overlay for secure remote access — no exposed ports, ever.
Nextcloud, media, dashboards & Docker workloads — real users, real uptime expectations.
A fully isolated SOC laboratory: adversary box on one side, hardened Windows domain on the other, and a SIEM watching everything in between. Every attack below actually ran. Every detection actually fired. Written up as formal SOPs, run like production.
// hover or focus any node to inspect it
Failed-logon burst reads as credential attack, not user error — pattern too fast, too uniform.
Correlate in Splunk, confirm at packet level in Wireshark — same source, scripted cadence.
Contained at the firewall, documented like an IR ticket, detection tuned for next time.
Emulated recon and brute-force attacks (MITRE T1595, T1110) from Kali against a live AD domain, then engineered Splunk detections on EventCode 4625 bursts and 4740 lockouts — validated end-to-end from packet to alert.
→ demonstrates: detection engineering · IR triage
Designed a dual-interface OPNsense deployment isolating the lab subnet with a bi-directional drop policy and egress-only internet — validated the boundary with scans and packet captures from both sides.
→ demonstrates: firewall policy · segmentation
Instrumented domain endpoints with Wireshark as the packet-visibility layer — capturing and dissecting attack traffic to answer the forensic questions logs can't: what actually left the host, and how.
→ demonstrates: network forensics · protocol analysis
Architected and operate a 20+ workload virtualization platform: deduplicated backups with enforced retention, DNS sinkholing, TLS-terminated reverse proxy, and WireGuard-overlay remote access.
→ demonstrates: infrastructure · hardening · resilience
In my lab the boundary is physical — a firewall rule I can point at. In cloud it's a policy document, and the blast radius of one bad line of JSON is bigger than anything I could misconfigure on a switch. So I'm learning it the same way I learned everything else: by building it, breaking it, and securing it — in the open.
Deployed Microsoft Entra Connect to synchronize an on-prem domain to the cloud — OU filtering to control sync scope, MFA enforcement, and a documented resolution for a real-world wizard authentication failure.
→ demonstrates: cloud identity · zero-trust foundations
Building a security-first AWS baseline per SAA best practices: organization-wide CloudTrail, GuardDuty threat detection, Security Hub CIS benchmarks, least-privilege IAM, and budget guardrails.
→ demonstrates: cloud security architecture
04 // arsenal
05 // evidence
CERTIFICATIONS
EDUCATION & OPERATIONS RECORD
Operating Systems · Networking · Distributed Systems · Cloud Computing
Every claim on this page maps to something I built and can demo live — certifications prove the knowledge, the lab proves the hands. That's the strongest signal I can give a team before day one.
06 // verdict
Ready to bring the same discipline I run my lab with to a cybersecurity or cloud security team. The evidence is above — the résumé is one click away.
$ contact --init shankar
email[email protected] linkedin/in/shankar-gurung-0b0a1b368 github/ShanKyTech résumédownload PDF ↓