Detecting, investigating, and understanding threats, with an offensive mindset that makes defense stronger.
I am a cybersecurity practitioner focused on defensive security: security operations, log analysis, digital forensics, and incident response. My daily practice is building detection skills, investigating realistic attack scenarios, and turning raw telemetry into clear, actionable findings.
I also hold hands-on Vulnerability Assessment and Penetration Testing (VA/PT) experience. Understanding how attackers think and operate makes me a more effective defender: I can validate detections, prioritise real risk, and communicate findings to both technical and non-technical audiences.
All of my practical work is conducted in isolated personal labs or on systems where explicit authorization exists.
| Area | What I Do |
|---|---|
| Security Operations (SOC) | Alert triage, investigation workflow, MITRE ATT&CK mapping, SIEM analysis with Splunk |
| Digital Forensics & Incident Response | Windows event log (EVTX) analysis, network forensics, malware delivery and data exfiltration detection |
| Threat Detection | Detection logic with Sigma and Chainsaw, log analysis, threat hunting on BOTS datasets |
| Threat Intelligence | Phishing and IDN homograph domain analysis, indicator-driven investigation |
| VA/PT (value-add) | Vulnerability assessment with Nessus, web application testing aligned to OWASP Top 10, VulnHub-style lab machines |
| Project | Description |
|---|---|
| homograph-scanner | Python tool that detects phishing domains and IDN homograph attacks through Punycode conversion and Unicode look-alike analysis. |
| Splunk-BOTS | Splunk Enterprise lab loaded with Boss of the SOC (BOTS) v1, v2, and v3 datasets for threat hunting and incident investigation practice. |
| evtx-dfir-lab | Python project for parsing and analysing Windows Event Logs (.evtx) in a DFIR workflow, supported by Sigma rules and Chainsaw. |
| network-forensics-case-study | Network forensics case study covering the detection of malware delivery and data exfiltration from captured traffic. |
| SOC-Analyst-Case-Study | A collection of SOC investigation case studies built around log analysis, threat detection, and incident response reasoning. |
| SOC_Analyst_Roadmap | Documentation and simulations of SOC Analyst L1 tasks, mapped to MITRE ATT&CK and the OSI model. |
| Project | Description |
|---|---|
| va-nessus-metasploitable2 | Vulnerability assessment of Metasploitable 2 with Nessus, covering scanning, severity analysis, and remediation recommendations. |
| web-pentest-lab | Web application penetration testing lab using OWASP Juice Shop. |
| EVM · vm-stapler-pentest · MR-ROBOT-1 · VM-RickdiculouslyEasy | Write-ups and notes on VulnHub machines, documenting enumeration, exploitation, and privilege escalation methodology in isolated labs. |
Detection & Analysis: Splunk · Sigma · Chainsaw · Windows Event Logs (EVTX) · MITRE ATT&CK
Assessment & Testing: Nessus · OWASP Juice Shop · Metasploitable · VulnHub
Languages & Scripting: Python · Shell
Frameworks & Concepts: MITRE ATT&CK · OWASP Top 10 · OSI Model · Incident Response Lifecycle
| Certification | Issuer | Date |
|---|---|---|
| Certified Ethical Hacker (CEH) | EC-Council (ANAB accredited) | Oct 2025 |
| Credential | Issuer | Date |
|---|---|---|
| Junior Penetration Tester Professional (Grade B) | Course-Net | Oct 2025 |
| Certified Cyber Security Engineer (CCSE) | CyberWarfare Labs | Jan 2026 |
| Certified Web Red Team Analyst (Web-RTA) | CyberWarfare Labs | Jan 2026 |
| Certified Red Team Operations Management (CRTOM) | Red Team Leaders | Jan 2026 |
| Understanding the OWASP Top 10 Security Threats (SKF100) | The Linux Foundation | Jan 2026 |
| XSS Exploits and Defenses (LFEL1010) | The Linux Foundation | Jan 2026 |
| Credential | Issuer | Date |
|---|---|---|
| Junior Cybersecurity Analyst Career Path | Cisco Networking Academy | Jan 2026 |
| Security Operations Fundamentals | Palo Alto Networks | Jan 2026 |
| SOC Analyst Course | Cyber Academy (Cyber Army Indonesia) | May 2026 |
| Blue Team Fundamental Course | Cyber Academy (Cyber Army Indonesia) | May 2026 |
| Foundations of Log Analysis for Cyber Defense | Red Team Leaders | Aug 2026 |
| Threat Intelligence Course | Cyber Academy (Cyber Army Indonesia) | Aug 2026 |
- Deepening skills in SOC operations, threat hunting, and DFIR
- Expanding detection engineering practice with Sigma and Splunk
- Documenting investigations as reproducible case studies
- Keeping offensive skills sharp so that defensive work stays grounded in how real attacks behave
- GitHub: @fahmipentest
- LinkedIn: www.linkedin.com/in/fahmi-riansyah-73b393268
- Email: fahmi.pentest@gmail.com
I am open to opportunities and collaboration in SOC Analyst, Blue Team, DFIR, and Security Analyst roles.
Disclaimer: All content in my repositories is created for educational purposes and executed only in personal lab environments or on systems with explicit written authorization. I do not condone unauthorized access or misuse of any technique documented here.