Attackers leave traces. I find them. Security+ and CySA+ certified, five documented labs, and a Medium write-up that walked through a full kill chain in Splunk. Everything in this portfolio is something I built. No checkboxes. Just bounties.
Something about tracing exactly what an attacker did, step by step through logs, clicked in a way that nothing else in tech had. So I chased that feeling into every lab I could build.
First-gen college student at HCC Tampa. 3.66 GPA, Dean's List. Transferring to USF for a B.S. in Cybersecurity in Fall 2027. Security+ and CySA+ are done. SC-200 is in progress. Each cert was a choice, not a checklist.
Six projects in this portfolio. Full malware analysis of Jigsaw ransomware — static in PEStudio, live detonation on Swordfish II with Process Monitor, written up across two Medium posts. A Splunk threat hunt that traced a full kill chain. A live honeypot that took 63 hits in 24 hours. A Wireshark automation that processed 24,834 packets. Real work, real findings, all documented. Recognized by the Last Mile Education Fund’s Microsoft Cybersecurity Talent Fund in Spring 2026.
"They say the bounty hunter who carries their work home will never rest. I carry Splunk dashboards."
Three-VM home lab simulating a full attack chain across four MITRE ATT&CK techniques: Initial Access, Persistence, Credential Access, and Lateral Movement. Built and documented every SPL query used to detect each technique. Wrote up the full investigation on Medium.
Full malware analysis of a 2016 ransomware sample. Static analysis with PEStudio uncovered hardcoded ransom notes, a Bitcoin address, and anti-VM behavior. Dynamic analysis on Swordfish II captured persistence mechanisms, process behavior, and AppData artifacts using Process Monitor. MITRE ATT&CK mapped across both phases.
Spun up T-Pot 24.04.1 on an AWS EC2 instance and left it exposed. In 24 hours, 63 attacks came in from 5 unique source IPs. Caught NMAP scans and SSH brute-force attempts. Used Kibana and Suricata to map each TTP back to MITRE ATT&CK.
Deployed a Windows VM in Azure, ran Tenable Nessus scans to surface vulnerabilities, then remediated with PSWindowsUpdate via PowerShell. Wrapped the whole thing in a GitHub Actions pipeline so the scan-patch-validate cycle runs automatically.
Analyzed 24,834 packets to identify anomalous top-talker IPs and unexpected protocol distribution across TCP, UDP, QUIC, and TLSv1.3. Automated triage of raw PCAP exports using Python and Pandas to cut down initial investigation time. Extended the project to include real-world malware PCAP analysis, investigating a Koi Stealer infection from Malware-Traffic-Analysis.net, identifying C2 beaconing to 79.124.78.197 via POST requests to /index.php and /foots.php, and correlating Suricata alerts with Wireshark HTTP stream analysis to confirm credential exfiltration.
Malware-Traffic-Analysis.net · "Big Fish in a Little Pond" (2024-09-04). Victim 172.17.0.99 on bepositive.com domain. C2 at 79.124.78.197:80 — nginx. Suricata ETPRO rule confirmed Koi Stealer C2 checkin. SMB scanning on 172.17.0.0/24 consistent with lateral movement.
SOC analyst roles, blue team internships, cybersecurity opportunities. Tampa, FL.
jwilliams.cyber@gmail.comIf you made it here, thank you. Hiring manager, fellow analyst, or just curious about the work — reach out. Everything here I built and documented myself.