Philip Zangara
SOC Analyst and Detection Engineer
I’m Philip Zangara, a SOC analyst focused on detection engineering and threat hunting. I build detections, hunt threats, and document security projects in my home lab using Splunk, Suricata, Sysmon, and MITRE ATT&CK.
Quick Recruiter Snapshot
Tampa, FL
Seeking SOC Analyst, Cybersecurity Analyst, and MDR Analyst Roles
Core Skills
Splunk • Suricata • Sysmon • Sigma • Linux • MITRE ATT&CK
Focus Areas
Threat Hunting • Detection Engineering • SIEM Operations
Certifications
CompTIA SecurityX • CySA+ • PenTest+ • Security+
Splunk Core Certified Power User • Splunk Core Certified User
Microsoft AZ-900
Security Blue Team Level 1
Highlights
- Reduced critical vulnerabilities by 50%, high by 100%, and medium by 83% through vulnerability remediation efforts
- Built a Splunk Threat Intelligence Dashboard using AlienVault OTX
- Built a Raspberry Pi-based Suricata IDS integrated with Splunk
Featured projects
Threat intel dashboard
I correlate AlienVault OTX indicators against live Sysmon telemetry in Splunk to find known-bad activity on my endpoints.
Linux STIG monitoring
I raised an Ubuntu 24.04 VM from 50.48% to 78.39% STIG compliance and mapped the findings to ATT&CK in a Splunk dashboard.
Network IDS on a Raspberry Pi
Suricata runs on a Pi 4 behind a port-mirrored switch and sends alerts to Splunk. I tuned out the noise so real hits stand out.
Latest posts
-
The Simple Series: Python Tools for Blue Team Triage
Building detection tools before landing a security job is one way to close the experience gap. The Simple series came out of that approach. Three…
-
Linux Security Monitoring with OpenSCAP and Splunk
A few months ago I started building out a home lab focused on detection engineering. This project covers Linux SIEM monitoring with Splunk and OpenSCAP…
-
Building a Threat Intelligence Dashboard in Splunk with AlienVault OTX
For the ECA Cyber Range Splunk Security Dashboard Challenge, I built a CTI dashboard that correlates AlienVault OTX threat intelligence against live Sysmon endpoint telemetry.…
I’m open to SOC Analyst and MDR roles. The fastest way to reach me is LinkedIn.