Don Lopez
SECURITY ANALYST / DEFENSIVE VALIDATION
Professional summary
Cybersecurity graduate and Security Officer experienced in monitoring, documentation, and escalation. Analyzes recorded AD telemetry and controlled security labs using Python, Splunk SPL and source-attributed technical reports. Security+ and CySA+ are résumé-reported.
Professional experience
Security Officer — Allied Universal
2019–Present- Monitor secure environments, maintain operational security logs and document observations requiring escalation.
- Prepare incident reports and communicate concerns according to established procedures. Physical-security work, distinct from paid SOC analyst experience.
Selected cybersecurity projects Independent capture analysis and labs
Active Directory attack-chain investigation
Correlated OTRF recorded host and packet evidence using process GUIDs, logon sessions and UTC clocks. Documented six rule/context findings with alternative explanations. View evidence ↗
Localhost web hardening
Verified four deliberately introduced HTTP-response issues stopped matching after scoped changes; repeatable assessment and remediation with 16 focused Python tests. View evidence ↗
Authentication investigation / Splunk
Investigated a 3-of-5 discrepancy in 64 fabricated authentication events; repaired inclusive 600-second correlation logic and reviewed a saved panel with 5 of 5 expected findings. View evidence ↗
Technical skills
Publicly demonstrated: Python · Sysmon · Kerberos · host/packet correlation · Splunk Enterprise · SPL · HTTP response hardening · Windows Event 4688 · synthetic DNS/HTTP PCAP · remediation verification · GitHub Actions · regression tests
Additional tools listed in the supplied résumé (not independently evidenced by these public labs): Sigma, Snort, Wireshark, Nessus, Nmap, Metasploit, VMware, Docker, Linux, Windows Server, SQL, basic AWS.
Education
B.S. Information Systems & Technology (Cybersecurity)
California State University, San Bernardino · Dec 2024
Certifications
CompTIA Security+ · résumé-reported
CompTIA CySA+ · earned Oct 2026 per résumé; issuer link pending
Evidence scope: Employment, duties and certification dates come from my supplied résumé (not independently verified). The AD case analyzes OTRF’s recorded emulation; other labs use synthetic or localhost inputs. The earlier Splunk panel is screenshot-reviewed training evidence. A separate 70-event synthetic live run confirmed indexed data and one native tracked scheduled alert; neither establishes production security efficacy.