SOC analyst and detection engineer. I build detections for real attacks, test them until they break, and fix what the testing finds.

Most of my work starts from something that actually happened that week, a new CVE or a campaign in the news, and ends with a detection, a test that proves it works, and an honest write-up of where it still falls short. I come from software engineering, so I treat detections like code: version controlled, tested on every push, and reviewed when they fail.

black-october-lab · one attack, the full security lifecycle

When the PHP2Shell bugs (CVE-2026-109618, CVE-2026-109619) hit in October 2026, I took them through every stage a security team would. I inventoried my own machine and found an Intel AMT management interface listening that I didn't know existed. I ran the vulnerable PHP version in a locked-down Docker lab, applied the vendor's emergency mitigation and proved it worked against the patched release. Then I treated the lab as compromised: contained it without destroying evidence, investigated with file diffs, process lists and logs, and wrote a tabletop incident report and a blameless postmortem. The fixes it called for are shipped and covered by tests.

Detection-Lab · six detections, tested on every push

Each detection has a PowerShell detector, sample data and Pester tests running in GitHub Actions, and most have a Sigma rule.

The stolen-key detection taught me the most. My first version learned "normal" from the same log it was checking, so when the attacker's sign-in came first, the attacker became normal. Fixing that poisoned baseline, and writing a test so it can't come back, is in the README.

leaked-key-lab · stopping the leak before it happens

A secret scanner plus a git pre-commit hook that refuses any commit containing an API key or private key. Tuned to cut the false positives a naive search produces (a plain sk- search flags words like "risk-"), and checked with planted canary keys so an empty result can be trusted.

sigma-detection-lab · four Sigma rules (LSASS credential dumping, security log cleared, svchost spawning cmd, whoami discovery) tested against real Windows EVTX attack recordings with a Python harness.

offensive-lab and nexusbank-pentest-lab · the attacker's side. HackTheBox write-ups, and a deliberately vulnerable Flask banking app attacked from Kali, each paired with how a defender would detect or stop it.

• sentinel: Java / Spring Boot service for FHIR R4 health insurance claims, aimed at Saudi Arabia's NPHIES platform. Validates claims, applies denial rules and keeps a PHI-safe audit log. In progress.
• inventory-management-system: Flask REST API and CLI with a mocked pytest suite
• workout-tracker-api: Flask API with session auth, bcrypt hashing and per-user data ownership
• secureops-cli, netprobe, sitecheck, scam-spotter-agent: smaller tools for team tracking, network diagnostics, security header grading and scam SMS detection

• Detection and response: Sigma, KQL, MITRE ATT&CK, incident response (PICERL), log and process analysis
• Testing and automation: Pester, pytest, GitHub Actions, git hooks
• Languages: PowerShell, Python, SQL, Java, JavaScript
• Lab: Docker, Kali Linux, Nmap, Nikto, SQLMap, Hydra, Metasploit (lab use only)

abbekibe2@gmail.com · open to SOC analyst, junior detection engineering and security-focused backend roles, remote or on-site.