Don Lopez
SOC ANALYST / SECURITY OPERATIONS
Professional summary
Cybersecurity graduate with Security Officer experience in monitoring, incident documentation, and escalation. Investigates recorded AD telemetry and controlled authentication, endpoint and network data using Python and Splunk. Security+ and CySA+ are résumé-reported.
Professional experience
Security Officer — Allied Universal
2019–Present- Monitor secure environments, maintain operational security logs and document observations requiring escalation.
- Prepare incident reports and communicate concerns according to established procedures. Physical-security work, distinct from paid SOC analyst experience.
Selected cybersecurity projects Independent capture analysis and labs
Active Directory attack-chain investigation
Analyzed OTRF’s recorded emulation: 25,993 host events and 1,121 packets. Joined process GUIDs, logon sessions and packet references; distinguished execution time from collection delay. View evidence ↗
Authentication correlation / Splunk Enterprise
Diagnosed a 64-event synthetic matrix where two inclusive ten-minute boundary cases were missed; corrected SPL and reviewed a saved panel showing 5 of 5 expected findings. View evidence ↗
DNS/HTTP packet investigation
Built a deterministic 20-frame synthetic PCAP and documented two bounded packet review signals with 18 tests; no live network traffic represented. View evidence ↗
Technical skills
Publicly demonstrated: Splunk Enterprise · SPL · Python · log correlation · Sysmon · Windows authentication · Kerberos · Windows Event 4688 · DNS/HTTP · PCAP analysis · MITRE ATT&CK investigative mapping · GitHub Actions
Additional tools listed in the supplied résumé (not independently evidenced by these public labs): Sigma, Snort, Wireshark, Nessus, Nmap, Linux, Bash, PowerShell, SQL, basic AWS.
Education
B.S. Information Systems & Technology (Cybersecurity)
California State University, San Bernardino · Dec 2024
Certifications
CompTIA Security+ · résumé-reported
CompTIA CySA+ · earned Oct 2026 per résumé; issuer link pending
Evidence scope: Employment, duties and certification dates come from my supplied résumé (not independently verified). The AD case analyzes OTRF’s recorded emulation; other labs use synthetic or localhost inputs. The earlier Splunk panel is screenshot-reviewed training evidence. A separate 70-event synthetic live run confirmed indexed data and one native tracked scheduled alert; neither establishes production security efficacy.