// Blue Team · Detection Engineering · SOC · DFIR
Cybersecurity Student
Blue Team · Detection Engineering · Security Operations
Moinuddin Ahmed · BTL1 Certified (Gold) · #6 India — CyberDefenders
I build practical security projects, write detection rules, investigate incidents, and improve continuously through hands-on labs and real-world challenges.
// featured
Featured Project
Detection Engineering Platform
A working environment for writing, testing, and validating detection logic before it reaches a SIEM. It takes a rule from an idea — mapped to a MITRE ATT&CK technique — through Sigma authoring, sample log testing, and false-positive review, so each detection is checked against real behavior rather than shipped on assumption.
View on GitHub01 / about
Who I Am
I'm a 3rd-year B.Tech CSE student at SRMIST, Kattankulathur, specializing in Cybersecurity with a clear focus on the Blue Team — detection, investigation, and defense rather than offense for its own sake. Most of what I know came from doing: running labs, breaking down incidents, and rebuilding the reasoning behind each alert until it made sense.
That practice led me toward Detection Engineering specifically — writing and testing the rules that turn raw logs into signal. My Detection Engineering Platform project grew out of wanting to see that pipeline end-to-end: technique, rule, test, validation. It sits alongside smaller tools on my GitHub, including a security operations toolkit and a password-audit utility.
On CyberDefenders I'm ranked #6 in India across Network Forensics, SIEM, Endpoint Forensics, Threat Intelligence, and Malware Analysis, and I completed the SOC Analyst Tier 1 track in April 2026. I hold the BTL1 certification with a 95% score and Gold Coin, and I make a point of showing up to conferences and training where I can — 0xCON Summit among them — to stay close to how working analysts actually think.
An internship at Jamia Darussalam Hospital gave me my first look at defending a live environment: mapping and securing 50+ networked devices with no prior structured inventory. I write up most investigations as technical walkthroughs, and I'm looking to bring that same habit of documentation and testing into a real SOC.
02 / skills
Skills
03 / certifications
Certifications
04 / experience
Experience
- Designed a workflow that takes a detection idea from a MITRE ATT&CK technique to a tested Sigma rule, rather than writing rules in isolation
- Built a testing layer that runs each rule against sample logs to check true-positive coverage before it's considered done
- Added a validation step to catch obvious false-positive conditions ahead of deployment, so rules ship with a documented rationale
- Physically located, catalogued, and mapped 50+ networked devices, establishing the hospital's first structured asset inventory
- Built an asset register with device details, locations, and unique IDs aligned with CIS Controls asset management principles
- Provided day-to-day support on the Hospital Information System (HIS), including setup, troubleshooting, and user assistance
- Supported day-to-day IT operations, including server room upkeep, in a live healthcare environment with zero prior downtime attributed to IT changes made during the internship
05 / projects
Security Projects
Problem: detection rules are often written and shipped without a repeatable way to test them against real behavior. Solution: a workflow that takes a MITRE ATT&CK technique through Sigma authoring, sample log testing, and false-positive review before a rule is considered done. Tech: Python, Sigma, MITRE ATT&CK. Outcome: detections that ship with a tested, documented rationale instead of an assumption.
Problem: threat intel is easy to collect but hard to turn into something a defender can act on. Solution: a research repo tracking IOCs, TTPs, and campaign patterns, mapped back to MITRE ATT&CK for use in detection work. Tech: Python, OSINT tooling, MISP. Outcome: a working reference that feeds directly into rule-writing for the Detection Engineering Platform.
Problem: blue team utilities are usually scattered across single-purpose scripts and browser tabs. Solution: a desktop toolkit that centralizes IOC lookups and threat-assessment utilities behind one interface. Tech: Python, CustomTkinter. Outcome: a reusable base for day-to-day triage tasks instead of rebuilding tooling per investigation.
Problem: weak password policies are hard to evaluate without seeing how they fail under attack. Solution: a GUI tool that simulates brute-force and dictionary attacks, including leetspeak substitutions, against a target policy. Tech: Python. Outcome: a concrete, testable view of where a password policy is weak — used to inform defensive controls, not just describe them.
06 / cyber range
Cyber Range & Achievements
07 / latest activity
Latest Activity
08 / contact
Let's Connect
I'm always interested in connecting with cybersecurity professionals, recruiters, and teams working in Blue Team, Detection Engineering, and Security Operations.