Don Lopez
SOC & Security Analyst candidate
I’m a CSUSB cybersecurity graduate focused on Windows investigations, Splunk detection debugging and Python automation.
Selected cybersecurity work
Active Directory investigation
Correlated 25,993 host events and 1,121 packets using process GUIDs, logon sessions and packet references. Identified six source-linked findings in recorded OTRF emulation; compromise remains unconfirmed.
Splunk SOC authentication lab
Validated 70 indexed synthetic authentication events, 5/5 expected detections, and one native scheduled-alert firing with its exact result. The temporary schedule was disabled after evidence capture.
Splunk Authentication Investigation Workflow
Processed 70 synthetic lab events from Splunk through Python validation, detection logic and source-linked reporting, producing six review candidates. Preserved UTC timestamps and evidence references for analyst handoff.
More investigations and tools: Firewall Policy Reviewer (synthetic lab, code and report) · AWS IAM Policy Reviewer (offline source and role-assumption case) · Windows process triage · Network analysis · Web hardening · Linux / SQL access audit.
Professional security experience
Allied Universal · Security Officer · 2019–present. Physical-security monitoring, security logs, incident documentation and escalation.
My approach: verify sources and timestamps, correlate related events, test alternative explanations and document a clear handoff.
Evidence scope: Employment is résumé-reported; linked certificate copies have private identifiers removed. These projects use recorded or synthetic lab data, not production incidents or performance metrics. A controlled Splunk lab confirmed indexed events and one tracked scheduled-alert firing; new-run screenshots remain pending, and production efficacy is not established. AD SPL/Sigma translations are unexecuted. Each case links its methods, controls and remaining limits.