Two role-focused résumé drafts use my supplied October 2026 résumé, including the correct education, Security Officer experience, and source-linked technical projects. For a third focus—Security Automation & Engineering—use the evidence-based engineering path; it is not a separate résumé or an employment claim.
The new printable résumés are designed for a clear one-page application and browser PDF export. Plain-text copies remain available for editing. All formats retain Don Lopez branding, omit the private phone number, and distinguish résumé-reported experience from public training-lab evidence. For a concise printable overview, open the recruiter profile.
Prioritizes investigating authentication findings, Windows process telemetry and network behavior.
Prioritizes repeatable assessment, remediation verification and contextual detection analysis.
Need a focused interview walkthrough? SOC Analyst evidence path ↗ · Security Analyst evidence path ↗ · Security Automation evidence path ↗
My supplied résumé lists Sigma/Snort rule practice, Wireshark, Nessus, Nmap, Linux, VMware, Docker, and AWS basics. It also reports expanded training outcomes; those source artifacts are separate from the published capture analysis and controlled labs, so the numerical results are not represented here as independently verified. Read the source distinctions ↗.
Same-host parent process GUIDs and logon sessions link remote PowerShell to its host context; matching TCP tuples and timing add network corroboration. A 39.812-second collection delay changes apparent ordering. This is independent analysis of OTRF’s recorded emulation, not an owner-operated capture or production incident. The Python analysis ran; its SPL/Sigma translations remain unexecuted. Inspect the source-linked case ↗
Both omitted cases depended on failures exactly 600 seconds before a success. The original streamstats time_window=10m query returned 3/5; the bounded replacement explicitly counted ages 0 through 600 seconds inclusive and the saved Splunk dashboard displayed 5/5 expected synthetic results. Review the discrepancy ↗
No. These are synthetic authentication events. Even with genuine operational events, confirm source integrity, MFA/session telemetry, account context, potential benign activity, and escalation authority before classifying compromise.
No. Four deliberately introduced rule violations stopped matching the localhost fixture after the changes. Browser enforcement, TLS, real application workflows and independent penetration testing were not established. Read the scope ↗
Complete tailoring checklist and evidence map ↗ · Printable recruiter profile →
Contact information, experience scope, and credential verification are documented below.
frailtycraven@gmail.com is the contact listed in both résumé drafts. My GitHub profile links to the public technical work. My résumé also lists LinkedIn.
My supplied résumé lists Allied Universal Security Officer experience (2019–present): monitoring, incident reports and escalation. The public capture analysis and controlled labs are independent technical projects, not SOC employment.
Security+ and CySA+ (earned October 2026 according to my résumé) are holder-reported; issuer verification links remain pending. Splunk SCCDA is planned, not earned. See how to share issuer-backed verification, including whether the badge displays your legal name, before making it public.
Current status and private/public boundaries: publication and application readiness record ↗.
The AD investigation analyzes OTRF’s public recorded emulation telemetry. Other reproducible exercises use synthetic, generated or localhost inputs. The Splunk screenshot records a genuine application result on that training data. Project work, employment history, and credential verification have distinct scopes; the linked case studies explain the evidence for each result.