Real problems, and how I solved them

• Thousands of alerts a day, and most are harmless.

  I triaged each alert by severity, source, affected user and device, and the rule that fired, checked that user’s or device’s history, and closed false positives with evidence.

• A single suspicious event rarely tells the whole story.

  In IBM QRadar I investigated offenses that tie together firewall, server, Active Directory and VPN logs. In Microsoft Sentinel I used KQL to chase cloud sign-in alerts such as impossible travel and risky sign-ins.

• Is this IP, link or file actually malicious?

  I checked indicators in VirusTotal, AbuseIPDB and Cisco Talos, and detonated suspicious files in Hybrid Analysis and ANY.RUN to see what they really do.

• Could company credentials or data already be exposed outside the network?

  I used dark web monitoring tools to watch for signs of leaked credentials and data, so exposure could be reported before it was abused.

• A machine looks compromised. What did the malware do?

  I read process trees, command lines, registry changes and network connections in Defender XDR and Cybereason, and mapped what I saw to MITRE ATT&CK.

• Phishing is where most attacks begin.

  In Proofpoint I checked sender reputation, SPF, DKIM and DMARC, email headers, links and attachments, and saw how KnowBe4 phishing simulations train users.

• A real incident has to reach the right people fast.

  I documented the evidence and recommended action under the SOPs and escalated to the L2 team: brute force, privilege escalation, command-and-control traffic and confirmed malware.

What I delivered

• Custom correlation rules and detection logic for brute force, lateral movement and data exfiltration, mapped to MITRE ATT&CK.
• Threat hunts through log telemetry that surfaced indicators of compromise.
• Incident reports in the PICERL format: findings, containment and lessons learned.
• DLP policy governance alongside daily monitoring.

Types of incidents I analysed

Identity and access brute-force and repeated failed logins, account lockouts, privileged account activity, VPN sign-in anomalies

Cloud impossible travel, risky sign-ins, new device registrations, Conditional Access alerts, suspicious Azure AD logins

Endpoint malware detections, ransomware-like behaviour, persistence, lateral movement, suspicious PowerShell

Network firewall deny events, unusual outbound traffic, command-and-control communication, policy violations

Email phishing, malicious attachments and links, spam campaigns, impersonation and business email compromise

What I learned about the job

A large share of the Sentinel alerts turned out to be false positives. That is why checking evidence before escalating matters: it protects the L2 team’s time for the incidents that count.

Tools

• IBM QRadar
• Splunk
• Microsoft Sentinel
• KQL
• Defender XDR
• Cybereason
• Proofpoint
• KnowBe4
• VirusTotal
• AbuseIPDB
• Cisco Talos
• Hybrid Analysis
• ANY.RUN
• Dark Web Monitoring
• MITRE ATT&CK
• PICERL

Real problems, and how I solved them

• A mentee must request a session for one skill, but the skills depend on the category.

  I built an Angular + Ionic form where choosing a category calls the REST API and loads only the matching skills.

• Sessions need a date and time the system can schedule reliably.

  I integrated the Google Calendar API for date and time selection and formatted the values the way the backend expects. Testing exposed wrong calendar slots, which I fixed.

• Incomplete or wrong data must never reach the database.

  I added Reactive Forms validation, error and fallback messages, and tested every endpoint in Postman. That caught null submissions and failed API calls.

• Mentees had no way to see what they had already requested.

  I built a reusable engagement list component that fetches from the Spring Boot + MySQL backend and updates instantly after a submission, with no page refresh.

How I got there

I first built a complete CRUD application on the same stack to learn how frontend, backend and database fit together, then took on the real module and read the requirements and data model before writing any UI.

Stack

• Angular 15
• Ionic
• TypeScript
• Spring Boot
• Java
• MySQL
• REST APIs
• Google Calendar API
• Postman
• Git / GitHub
• Maven
• IntelliJ
• VS Code

Real problems, and how I solved them

• Finding one fact inside long PDFs is slow.

  A Streamlit page lets the user upload PDFs and ask in plain English. PyPDF2 pulls out the text.

• An AI model cannot read a whole large document at once.

  The text is cut into 10,000-character chunks with 1,000 overlap, so nothing is lost at the edges. Each chunk becomes a Google Generative AI embedding in a local FAISS index, and only the most relevant chunks are fetched for each question.

• AI models make up answers when they are unsure.

  My prompt tells Gemini Pro to answer only from the supplied context and to say the answer is not available if it is not there. I also kept the temperature low.

• Users ask follow-ups and need to review earlier answers.

  The session keeps the full chat history on screen, and the API key stays in an environment variable instead of the code.

How I chose the tools

I explored Pinecone, ChromaDB and FAISS, plus Hugging Face models and OpenAI. I used FAISS locally because it gave fast similarity search with no extra service to run.

Stack

• Python
• Gemini AI
• LangChain
• FAISS
• ChromaDB
• Pinecone
• Hugging Face
• Streamlit
• PyPDF2

I came back to this pattern in my RAG PDF Chatbot project.

Real problems, and how I solved them

• Turning a written problem into a working formula.

  Simple interest, speed, pond water volume and a BMI calculator with health categories, each run against sample inputs.

• Programs that must respond to what the user types.

  A jumping-jacks workout loop with early exit, and a Hangman game that validates single letters, rejects repeats, gives hints and ends after six wrong tries.

• Working with collections of data.

  Adding, moving, replacing and sorting list members, a city-to-country lookup, and a dice simulation counting sixes and consecutive sixes.

• Getting information from a website automatically.

  A web scraper with Requests and BeautifulSoup that downloads a page and extracts its text.

How I worked

On my own and at my own pace. I wrote each task in a Jupyter notebook, ran it, fixed the errors and put every task and output into one clean submission. This is where I practised object-oriented thinking, automation and scripting in Python.

Stack

• Python
• Jupyter
• Requests
• BeautifulSoup
• OOP
• Automation