Open to SOC Analyst & detection roles

Antonio Beltran-Miller

SOC Analyst · Detection & Automation · Bug Bounty Researcher

Security+ certified professional transitioning into a SOC role. I build detections and automation in my home lab, deploy honeypots to capture real-world threat telemetry, and conduct bug bounty research to analyze practical intrusion techniques.

See the work Download résumé

Ann Arbor, Michigan GitHub LinkedIn Email

I spent about two and a half years as the only IT person for a 200-person logistics company, so I know what a normal Windows and Active Directory environment looks like and how to keep people working while something is broken.

Since then I have been building toward security operations on purpose: a Splunk, n8n, and GPT-4 alert-triage pipeline in my lab, distributed T-Pot honeypots for live attack data, and responsible bug bounty disclosure. I would rather show a smaller number I can defend than a big one I cannot.

What I can do

Where I'm ready to contribute

Alert triage & SOC operations

Worked a full phishing alert end to end (SOC338) and built a Splunk-to-Slack triage pipeline with AI-assisted enrichment.

Detection engineering

Wrote 10 Splunk rules mapped to MITRE ATT&CK plus Suricata signatures, and validated each by running the attack myself.

Vulnerability research

Escalated an npm supply-chain RCE from P4 to P2 (CVSS 8.9) and pulled CVE-exploitation detections from live honeypots.

Incident response

Contained an active WordPress compromise, removed the persistence, and restored operations in about 2.5 hours.

Projects & research

Things I built, and what they taught me

Home-lab detection work and bug bounty research. Each write-up is honest about what I built, what I based it on, and what the screenshots actually show.

Home lab · detection + automation

AI-Assisted SOC Automation Lab

A Splunk → n8n → GPT-4 → Slack triage pipeline I built in a four-VM lab, with ten detection rules I validated by running the attacks myself.

“The rules only got useful after several tuning passes drove the false positives down. That loop, not the first rule, was the real work.”

Cut my own triage time from 45 to 8 minutes across 10 self-run attacks

Splunkn8nGPT-4 APISysmon 4 min read

Home lab · threat intel

T-Pot Honeypot Threat Intelligence

Distributed T-Pot honeypots on a public VPS. Most of it is automated scanning noise. The useful work was finding the few patterns worth alerting on and reporting the infrastructure behind them.

“424k attacks, and almost all of it is noise. The skill is finding the handful of sources worth a second look, and doing something with them.”

424k+ attacks logged; wrote Suricata rules and reported malicious IPs to AbuseIPDB

T-PotSuricataElasticsearch / KibanaCowrie 4 min read

LetsDefend training · SOC338

SOC Alert: Lumma Stealer via ClickFix

A simulated phishing alert I triaged end to end on LetsDefend: email through the ClickFix lure, mshta LOLBin abuse, payload confirmation, containment, and a tier-2 handoff brief.

Confirmed true positive · full kill chain traced · host contained · tier-2 brief written

Bug bounty · Bugcrowd

npm Supply-Chain MITM Vulnerability

A public repo shipped an .npmrc pinned to HTTP. I built a man-in-the-middle proof of concept showing it enabled RCE through package injection, and argued the severity up from P4 to P2.

Escalated P4 → P2 on Bugcrowd; the repo enforced HTTPS after disclosure

Personal tool · bug bounty tooling

Blind XSS Capture Tool

A self-hosted blind-XSS callback server I built to use in my own authorized bug bounty testing. One script deploys an SSL dashboard that logs payload fire-backs.

Personal tool I built and use; tested against a CTF lab target

Write-ups

Investigation write-ups

Short reports on real honeypot events and an incident response case, written the way I would hand them to another analyst.

All write-ups

Incident Response

WordPress Compromise: Containment and Recovery

A site owner said the site was "acting up." It was an active compromise. Tracing it to a vulnerable plugin, pulling out the persistence, and getting them back on a clean build in about 2.5 hours.

Dec 15, 2024 4 min read

VoIP Security

A VoIP Toll-Fraud Probe on My Honeypot

Sentrypeer and Suricata caught a burst of SIP INVITEs from a rented VPS, dialing sequential premium-rate numbers behind a spoofed Cisco vendor string. A probe looking for a PBX to run up a bill on.

Sep 22, 2025 3 min read

Threat Intelligence

A Commercial Scanner Cataloging My Services

One event in my logs was not an attack at all: a clean handshake, a banner grab, and an immediate reset from a commercial scanner. Worth writing up precisely because it looks boring.

Sep 24, 2025 3 min read

Threat Intelligence

Someone Fingerprinting My Honeypot

Suricata flagged a full TLS handshake against 64297/TCP. That port is specific to T-Pot’s own dashboard, so this was not a generic scan. It was something checking whether the box is a honeypot.

Sep 20, 2025 3 min read

Toolkit

Tools I actually use

Grouped by what I reach for, not rated on a scale. Most of these show up in the projects above.

SIEM & detection

Splunk (SPL, dashboards, alerts)Suricata rule writingSysmonWiresharkMicrosoft Sentinel (familiarity)

Security operations

Alert triageIncident response (NIST 800-61)Threat huntingIOC analysisMITRE ATT&CKDiamond Model

Systems & cloud

WindowsActive DirectoryLinuxTCP/IPAWS fundamentals (CloudWatch, GuardDuty, IAM, VPC)

Automation & tooling

PythonBashPowerShelln8nGPT-4 APIVirusTotal / AbuseIPDBMetasploitBurp Suitemitmproxy

Credentials

Certifications

Verifiable where a badge exists. In-progress items are marked as such, so nothing aspirational is dressed up as earned.

CompTIA Security+

CompTIA

October 2025

Threat detection & responseRisk & vulnerability managementNetwork securityCryptography & PKI

Verify

CompTIA CySA+

CompTIA

In progress · expected October 2026

Behavioral analyticsThreat huntingIncident responseVulnerability management

LetsDefend SOC Analyst Path

LetsDefend

February 2025

SIEM analysisAlert triageMalware analysisIncident response

Verify

Google Cybersecurity Professional

Coursera / Google

November 2024

Python automationLinux & SQLSIEM toolsNIST frameworks

Verify

Fortinet Certified Associate

Fortinet

August 2025

FortiGate configurationVPN (IPsec/SSL)IPS/IDSSecurity policy

Verify

Fortinet FortiGate 7.6 Operator

Fortinet

August 2025

FortiGate 7.6 operationsFirewall managementSystem monitoring

Verify

AWS Security Best Practices

AWS Training

2025

CloudWatch & GuardDutyVPC securityIAMMonitoring & alerting

Course completion (no public badge)

SailPoint Identity Security Leader

SailPoint

2025

Identity governanceAccess managementIAM strategy

Verify

Background

Experience & education

I am early in my security career and would rather say so plainly. My IT foundation is the ALM Freight role; the delivery jobs are how I have paid the bills while studying.

Dispatcher (sole IT resource)

ALM Freight

Sep 2021 – May 2024

▸Only IT resource for a 200-person, two-site logistics operation with no dedicated IT department.
▸Managed the endpoint fleet across Windows 10 workstations and 42 Android devices via 42Gears MDM, with manual patch management across the full fleet.
▸Administered Active Directory (user provisioning, account management, and group policy), and onboarded new employees from a standardized least-privilege Windows image.
▸Primary technical contact for 200+ drivers, resolving delivery-software and device failures in real time.

Delivery Associate

MMML (Amazon DSP)

Sep 2025 – present

Delivery Associate

DBE Logistics (Amazon DSP)

May 2024 – Aug 2025

Assembly Technician

Contour Windows

Aug 2019 – Aug 2021

B.S. Cybersecurity & Information Assurance

Western Governors University

Online · expected 2027

Contact

Let's talk

I'm looking for a SOC Analyst or detection role and I'm prepared for rotating shifts. Happy to walk through any of these projects live, including what I'd do differently.

Based in Ann Arbor, MI. Open to onsite in the Detroit metro, hybrid, or remote, and ready for rotating and off-hours SOC coverage.

AntonioBeltranMiller@gmail.com GitHub LinkedIn