Career changer. 3 CompTIA exams in 5 months. Building toward SOC Operations.
I don't just study for certifications — I build labs, break things, and document what I find.
I'm building a career in Security Operations — learning how attacks work in order to detect, analyze, and respond to them effectively.
My goal: a SOC Analyst role where I contribute to threat detection, alert triage, and incident response. I believe the best defenders understand how systems can be broken — so I build labs that reflect real attack scenarios and document every finding.
| Certification | Status | Date |
|---|---|---|
 |
✅ Passed | Jan 2026 |
 |
✅ Passed | Mar 2026 |
 |
🔄 Studying | 2026 |
I learn by doing. My HomeLab Projects and HomeLab Aegis repos document real hands-on work — not tutorial copy-paste, but actual discovery, mistakes, and lessons. Aegis goes deeper: IDS deployment, SIEM integration, exploitation and detection.
| Machine | Specs | OS | Role |
|---|---|---|---|
| 💻 MacBook Pro | 16GB RAM · 500GB SSD | macOS | Primary workstation — scanning, documentation, analysis |
| 🖥️ iMac 12,1 | 32GB RAM · 500GB HDD | Ubuntu | Lab server — network services, security tool hosting |
| 🐉 Lenovo TP | 16GB RAM · 500GB SSD | Kali Linux | Security testing & vulnerability scanning |
| 🐧 MacBook Pro- VirtualBox | - | VM Ubuntu | |
| 🐧 Lenovo TP- VirtualBox | - | VM Ubuntu | |
| 📡 Fritz!Box | — | — | Network gateway, DHCP server, DNS |
| 📶 TP-Link RE190 | — | — | Wi-Fi repeater — discovered via MAC analysis in Lab 0 |
| # | Lab | Tools | Focus | Status |
|---|---|---|---|---|
| 0 | Network Discovery | ifconfig, arp, nmap, ping | Network topology mapping, port scanning, MAC analysis, security assessment | ✅ |
| 1 | Wireshark Traffic Analysis | Wireshark, curl, ping, nslookup | Protocol analysis (ICMP/DNS/HTTP/ARP/TLS), TCP lifecycle, JA3 fingerprinting, passive device ID | ✅ |
| 2 | WiFi Security | aircrack-ng suite, hcxdumptool, hashcat, macchanger | WPA2 handshake capture, PMKID attack, deauth, MAC spoofing, offline cracking | ✅ |
| 3 | Firewall & Segmentation | ufw, iptables, nmap, hydra | Host firewall, zone segmentation, brute force detection, log analysis | ✅ |
| # | Chapter | Scenario Question | Status |
|---|---|---|---|
| 01 | IDS Deployment | Can we detect a port scan and brute force in real time? | ✅ |
| 02 | SIEM Integration | Do Suricata alerts reach Wazuh? Can we build a dashboard? | ✅ |
| 03 | Exploitation & Detection | If Metasploit gets a shell — does the IDS see it? | 🔜 |
| 04 | Lateral Movement | Can SIEM detect movement between hosts post-compromise? | 🔜 |
| 05 | PCAP Forensics | What does C2 and infostealer traffic look like in a PCAP? | 🔜 |
| 06 | Detection Rule Writing | Can we write a Suricata rule that catches a specific threat? | 🔜 |
| 07 | Incident Response | Can we build a full IR timeline and harden the environment? | 🔜 |
A certification proves you studied. A lab proves you understand.
I do both.
- 🔍 I question results before accepting them
- 📝 I document findings, not assumptions
- ⚡ I treat every lab as a real environment
- 🔁 I revisit and improve — no lab is ever truly finished
📖 Studying CompTIA Network+ while building hands-on security labs 🧪 Running firewall and traffic analysis labs — documenting everything 🎓 Cybersecurity Weiterbildung in Germany — finishing late 2026 💻 TryHackMe Cybersecurity 101 — 51% complete
Started from zero. 3 exams in 5 months. Still learning, still building — every lab teaches something new. 🚀