Security Operations
whoami
Mihai Ionut Botos
SOC Analyst | Threat Detection | Incident Response
cat summary.txt
SOC Analyst with hands-on experience investigating phishing, endpoint, identity, SIEM, and cloud security alerts across enterprise environments. Certified in CompTIA Security+ and HTB Certified Security Defense Analyst (CDSA), with practical experience using Microsoft Sentinel, Defender XDR, Azure-based SOC automation, Splunk, XSOAR, Suricata, Palo Alto Panorama, and Active Directory telemetry. Marine Corps veteran with an active security clearance, operational leadership experience, and a defensive security focus informed by offensive security training.
📍 Cluj-Napoca, Romania
About
Defensive security, built on operational discipline
SOC Analyst with hands-on experience investigating phishing, endpoint, identity, SIEM, and cloud security alerts across enterprise environments. Certified in CompTIA Security+ and HTB Certified Security Defense Analyst (CDSA), with practical experience using Microsoft Sentinel, Defender XDR, Azure-based SOC automation, Splunk, XSOAR, Suricata, Palo Alto Panorama, and Active Directory telemetry. Marine Corps veteran with an active security clearance, operational leadership experience, and a defensive security focus informed by offensive security training.
Experience
Where I've worked
Security operations roles and leadership experience, from enterprise SOC work to Marine Corps field operations.
Security Operations Center Analyst
March 2025 – PresentSIG Group
Show details (4 more)
- Deploy Azure-based incident response playbooks supporting identity containment and hybrid directory response workflows across Entra ID and on-premises Active Directory.
- Built automated email-analysis workflows that extract IOCs, query threat intelligence APIs, and publish review-ready context, including header artifacts, to incidents and audit channels.
- Correlate alert evidence across security tooling to validate suspicious activity, document findings, and support timely escalation or closure.
- Create clear investigation notes and response documentation to improve SOC handoffs and repeatability.
Security Operations Center Analyst
March 2024 – March 2025Betfair Development Romania
Show details (3 more)
- Used Suricata, Palo Alto Panorama, Windows Active Directory events, and endpoint telemetry to analyze suspicious network and host activity.
- Reviewed phishing reports and security alerts, documented findings, and coordinated response actions with security stakeholders.
- Contributed to detection and incident response improvements by documenting recurring alert patterns and investigation procedures.
Team Leader
September 2019 – March 2023U.S. Marine Corps
Show details (2 more)
- Managed secure communications support for artillery exercises in the Pacific region and received an excellence award for communication support.
- Maintained an active security clearance and enforced disciplined handling of sensitive operational information.
Radio Operator
April 2018 – November 2019U.S. Marine Corps
Show details (3 more)
- Improved contingency and emergency response procedures for field communications.
- Trained 15 personnel on communication equipment, operating standards, and emergency procedures.
- Supervised 4 personnel, providing mentorship and performance oversight.
Skills
Tools & technical skills
Filter by category to see the tools I work with day to day.
- Microsoft Sentinel
- Microsoft Defender XDR
- Splunk
- XSOAR
- Kibana
- Suricata
- Snort
- Zeek
- Wireshark
- Palo Alto Panorama
- Sysinternals Suite
- Azure
- Sentinel Playbooks
- Entra ID
- Active Directory Security
- Windows Event Analysis
- Identity Telemetry
- Threat Detection
- Incident Response
- Phishing Analysis
- Vulnerability Assessment
- Digital Forensics
- Malware Triage
- Security Monitoring
- Linux
- Windows
- macOS
Highlights
Key initiatives
Selected work from SOC automation, incident response, and hands-on professional development.
- SOC Automation
Automated Email-Analysis IOC Workflow
Built an automated workflow that extracts indicators of compromise from reported emails and enriches them for faster triage.
Designed and deployed an automated pipeline that parses reported phishing emails, extracts IOCs (senders, links, attachments, headers), queries threat intelligence APIs for enrichment, and publishes review-ready context to incident and audit channels — reducing manual triage time and improving investigation consistency.
- Incident Response
Azure Identity Containment Playbooks
Deployed Sentinel playbooks for identity containment across hybrid Entra ID and on-prem Active Directory environments.
Built and maintained Microsoft Sentinel automation playbooks that support identity containment actions (session revocation, account disable, credential reset guidance) across hybrid directory environments, coordinating response between cloud-native Entra ID and on-premises Active Directory.
- Professional Development
Hack The Box — CDSA Path
Completed the Certified Security Defense Analyst path: SOC investigations, SIEM operations, malware analysis, and forensics.
Completed hands-on labs covering SOC investigations, SIEM operations, malware analysis, Active Directory attack detection, and digital forensics. Built practical familiarity with password attacks, Windows authentication internals (LSASS, NTLM, SAM), Nmap enumeration, web reconnaissance, and common attacker TTPs.
Projects
Home lab & personal projects
A self-hosted home lab used to practice the security engineering side of the job — network defense, detection engineering, and identity — outside of work hours.
- Detection Engineering
Home Detection Engineering Lab
Self-hosted, segmented lab environment for practicing detection engineering and threat hunting outside of formal coursework.
Built and maintain an isolated virtualized lab with separate attacker, target, and detection segments, running an Elastic-based SIEM (Elasticsearch + Kibana) to write, test, and tune custom detections against simulated attacker activity — complementing HTB and detection-engineering coursework with hands-on, self-directed practice.
- Network Security
Segmented Home Network & Perimeter Firewall
Designed a segmented home network behind a dedicated firewall appliance, with stateful rules and VPN-only remote access.
Architected and maintain a segmented home network (server, management, and IoT segments) behind a dedicated firewall/router appliance with stateful filtering, restricted access to management interfaces, and remote access locked to an authenticated VPN — no services directly exposed to the internet.
- SIEM / Logging
Centralized Log Pipeline & SIEM Migration
Consolidating logs from network and host sources into a centralized SIEM, migrating the pipeline to an Elastic/Kibana stack.
Designing and rolling out centralized log shipping from firewall and host sources into a unified Elastic/Kibana pipeline, replacing an earlier log-aggregation deployment — mirroring the log pipeline and alerting patterns used in enterprise SIEM platforms at work.
- Identity & Access
Self-Hosted Identity & Secrets Management
Deployed self-hosted secrets management and is rolling out centralized SSO to apply least-privilege access across home services.
Deployed a self-hosted password manager for centralized secrets handling and is implementing a dedicated identity provider for single sign-on across self-hosted services — applying the same least-privilege, centralized-identity principles used with Entra ID and Active Directory in enterprise environments.
Certifications
Certifications
HTB Certified Security Defense Analyst (CDSA)
June 2024
CompTIA Security+
September 2023
Transmission Systems Supervisor
August 2023
NGT Cyber Security Associate
July 2023
Currently sharpening
- In ProgressCentri
Certified Detection Engineer (CDEA)
Building detection engineering expertise — writing and tuning detections, not just responding to them.
- In ProgressLevel Effect
CDETH — Detection Engineering & Threat Hunting: Windows
Deep-dive coursework on Windows-focused detection engineering and threat hunting.
Education
Education & professional development
Southern New Hampshire University (SNHU)
Bachelor's Degree in Cyber Security
GPA: 3.27
NGT Academy
Full Stack Network Associate and Cyber Security Accelerator
Completed 2023 — foundational networking and cybersecurity training through simulations, labs, and hands-on projects.
Hack The Box
Member Since June 2023
- Completed the CDSA path, gaining hands-on experience in SOC investigations, SIEM operations, malware analysis, Active Directory attack detection, and digital forensics.
- Built practical familiarity with password attacks, Windows authentication mechanisms, LSASS, NTLM, SAM database analysis, Nmap enumeration, web reconnaissance, file transfer techniques, privilege escalation, and common TTPs.