Cybersecurity Analyst

Warsaw 2026

SodikTursunboev.

Attackers leave traces.I know where to look.

SECURITY OPERATIONS

Holder: Sodik Tursunboev
Role: SOC Analyst
Based in: Warsaw, Poland
CEH credential ID: ECC5142870936

Verify CEH certification

Threat detection, incident investigation and security automation, supported by hands-on security projects.

Explore projects Portfolio brief

Certified Ethical Hacker (CEH)

Top 1%TryHackMe, worldwide Top 1%Blue Team Labs Online, worldwide#6 in Poland

Ranking snapshot: 30 October 2026

View CV online Download CV (PDF)

Compare projects All projects

Selected projects

Selected work in detection engineering, attack simulation and security automation.

Detection engineering

Custom SIEM + Sentinel BAS

A custom Python SIEM paired with Sentinel BAS to validate detection rules, correlate alerts and investigate missed attack simulations.

Evidence Seven simulations produced matching alerts; three did not. A missing parser field explained the Kerberoasting miss.

My contribution: Built the SIEM, Sentinel BAS simulations and alert-to-test matching.

Purple team lab

Active Directory Purple Team Lab

An isolated Active Directory lab exploring credential abuse, lateral movement and domain compromise, with documented telemetry and defensive analysis.

Evidence Recorded Windows Security, Sysmon and OpenSSH evidence across the attack chain.

Windows Security + Sysmon4624 · 4769 · 4672Controlled credential abuse, lateral movement, DCSync, Golden Ticket and SCP scenarios.

My contribution: Built the lab, reproduced the attack chain and documented defensive findings.

Security engineering

ARGUS

A Windows assistant in active development, combining voice and text interaction, bounded agent workflows and desktop automation with backend authorization controls.

Evidence Public Windows source release with voice, desktop workflows, bounded agents, a 3D state view and documented setup.

Recorded ARGUS interface from an earlier build; the current source uses the V2 Svelte HUD

My contribution: Developing the assistant, V2 HUD, agent kernel, Windows skills, monitoring and backend security controls.

Detection evidence

See how I validate detections and investigate gaps.

Explore validation & rules Project evidence

Original screenshots and lab records

Project evidence

Select an original screenshot or lab record to inspect its context and source.

Recorded project screenshotSIEM + Sentinel BAS

View full-size image

Sentinel BAS results

Sentinel BAS matches attack simulations to SIEM alerts and presents the validation results.

Read case study Read repository source

About me

I analyze Windows and Linux activity to investigate suspicious behavior and understand its impact.

I work with Splunk and the Elastic Stack (ELK: Elasticsearch, Logstash and Kibana), alongside SIEM, SOAR and EDR tools.

My practical work covers log analysis, phishing and malware investigation, digital forensics and incident response. I correlate events, examine endpoint artifacts and document findings and response recommendations.

My offensive security background includes web application testing (OWASP), Active Directory attack simulation and red teaming. I use that understanding to investigate attacker behavior and evaluate defensive coverage.

Sodik Tursunboev at a cybersecurity congress, with the Warsaw skyline behind him — At a cybersecurity congress in Warsaw

Capabilities in practice

Follow each capability to the work or learning evidence behind it.

Security analysis

Detection validationDocumented lab evidence
Windows telemetry analysisDocumented lab evidence

Offensive security

Active Directory attack emulationDocumented lab evidence
Web application securityHands-on learning path

Engineering & automation

SIEM developmentDocumented lab evidence
Policy-controlled automationDocumented lab evidence

Cyber Intelligence

Online safety for everyone

Would you spot a fake delivery text? Learn how to protect your passwords, recognise scams and secure your accounts.

Explore the lessons →Take the quick test →

Certifications

Select a certificate to view it full size.

Certification

Certified Ethical Hacker (CEH)

Issued by EC-Council, October 2025

Certificate number ECC5142870936

Verify credential

Selected hands-on learning paths

SOC Level 165 hours 29 minutesFebruary 2026

Red Teaming50 hours 20 minutesFebruary 2026

Jr Penetration Tester30 hours 40 minutesJanuary 2026

Top 1%

TryHackMe, worldwide240+ practical rooms completed and 49 badges earned across SOC, red teaming, and penetration testing.View profile

Articles

Technical write-ups documenting security projects, investigations and findings from testing.

October 202610 min read
Investigating Suspicious Windows Processes
A practical investigation workflow using Windows logs, Sysmon, Process Explorer and Autoruns.
September 20264 min read
ARGUS: Security Controls for Local AI
Authorization, integrity checks, sandboxing, and the limits of a Windows AI assistant.
August 20265 min read
Active Directory: Attack Paths and Telemetry
An attack-chain walkthrough in my own lab, with event sources and defensive analysis.