Open to SOC / Security Analyst roles — Vadodara (on-site / hybrid) & remote

I work the blue side of security — finding the incident hidden in the logs.

Working as: SOC Analyst|

Hi, I'm Eeshan. I'm a cybersecurity professional focused on SOC operations (L1/L2), incident response, digital forensics and threat hunting. I've investigated a real brute-force attack end to end, completed four security internships, and published peer-shared research on application security (SSRN, 2026). That's the kind of work I want to do full-time.

0+
open-source projects
0
security internships
0+
technical write-ups
0+
LinkedIn connections

About

Defensive by focus, offensive by training.

My route into security wasn't a straight line from a textbook. It came from labs, CTFs and late-night PCAP files — pulling apart network traffic until a MitM attack or a quiet data exfiltration finally made sense. That hands-on habit is still how I learn, and it's why I publish my investigations instead of just finishing them.

I hold the CRTA (Certified Red Team Analyst) certification, which taught me how attackers actually move. I use that every day on the defensive side: triaging alerts, hunting through logs in Splunk, and asking "if I were the attacker, what would I do next?"

I'm based in Vadodara, Gujarat, pursuing a B.Tech in Computer Science & Engineering (2023–2027, CGPA 8.2) at Parul University — coursework in Network Security, Ethical Hacking, Digital Forensics and Cloud Security. Alongside my degree I've trained across 25+ global platforms, including IBM, Cisco, EC-Council and Homeland Security programmes.

What I'm looking for now is a SOC or security analyst seat where I can do this for a real organisation — monitor, investigate, respond, and keep getting better at it.

What I actually do

  • Alert triage & investigation (SOC L1/L2)
  • Incident response — containment, evidence, reporting
  • Log analysis & SIEM queries in Splunk (SPL2)
  • Threat hunting mapped to MITRE ATT&CK
  • Network forensics with Wireshark & tcpdump
  • Security automation in Python

Experience & journey

Where I've done the work

  1. May – Jul 2026 · Hybrid

    Security Operations Intern — CodeAlpha

    Worked on network security and IDS/IPS concepts, and explored phishing awareness and threat detection methodologies. Public deliverables from this period include SentinelSight and my phishing awareness training module.

    SOC · IDS/IPS · Phishing · Threat Detection

  2. Jan – Mar 2026 · Remote

    Cybersecurity Tools & System Development Intern — Cryptonic Area

    Triaged simulated security logs in Splunk, classifying alerts and reducing false-positive review time. Built work around secure authentication and vulnerability reporting, ran simulated incident response scenarios, and documented mitigation strategies.

    Splunk · Alert Triage · Incident Response · Reporting

  3. Apr – Jul 2025 · Remote

    VAPT & Security Analysis Intern — Plasmid Innovation Ltd

    Performed vulnerability assessment and reconnaissance, and worked across VAPT, incident response and security monitoring concepts — strengthening defensive practice with real tooling.

    VAPT · Recon · Security Monitoring

  4. Nov – Dec 2024 · Remote

    Cybersecurity Intern — ShadowFox

    Hands-on work in system security concepts and vulnerability identification — where the internship run started.

    System Security · Vulnerability Identification

  5. Virtual simulations · Forage

    Cybersecurity Job Simulations — Mastercard, PwC, ANZ, AIG, JPMorgan & Telstra

    Completed six employer simulations covering SOC operations, incident response, threat monitoring and risk analysis.

    SOC Operations · Risk Analysis · Threat Monitoring

  6. Incident Response — hands-on investigation

    Brute-force attack investigation

    Investigated a live brute-force attack: identified the attack vector from authentication logs, traced the source, and prepared forensic evidence and a written incident report. This is the investigation I point recruiters to first — it's real response work, not a tutorial exercise.

    Incident Response · Log Analysis · Forensics · Reporting

  7. 2024

    CRTA — Certified Red Team Analyst

    Offensive security certification covering red-team tactics, techniques and threat modelling. Splunk Intro to SPL2 completed the same year for SIEM and log investigation.

    Red Teaming · Penetration Testing · Splunk SPL2

  8. Recent — from my LinkedIn

    DFIR workshop & SOC operations in practice

    Attended a DFIR workshop — “From Digital Evidence to Digital Investigations” — by Drona Cyber Solutions at Parul University, and documented hands-on SOC operations work with Sophos Firewall and ManageEngine Log360, connecting day-to-day monitoring to real-world threat intelligence and OSINT.

    DFIR · Sophos Firewall · Log360 · Threat Intelligence

  9. Training — C3iHub, IIT Kanpur

    7-day cybersecurity training

    Completed an intensive 7-day programme covering VAPT, PowerShell, BitLocker and Wazuh EDR with C3iHub, IIT Kanpur — documented day by day on LinkedIn, because showing the learning curve honestly is part of the point.

    VAPT · PowerShell · BitLocker · Wazuh EDR

  10. Ongoing

    Security research, CTFs & labs

    Regular CTF participation (including pwn.college), enterprise security labs, and OSINT investigations — most of which become the Medium write-ups below.

    CTF · OSINT · Threat Analysis

Published research

The paper — UASAF

SSRN · 2026 · Research Publication

Unified Application Security Assessment Framework (UASAF)

Garg, E. (2026)

I developed the Unified Application Security Assessment Framework, integrating static code analysis, B2R CTF exploit-chain simulation, and phishing vectors into one assessment model. The headline finding: 94.3% of exploitable attack chains involve compounding vulnerabilities — single flaws rarely break an application on their own; it's the chain that does it. That's exactly why I assess applications the way an attacker chains them.

Read the paper on SSRN ↗ DOI: 10.2139/ssrn.7014078
0% of exploitable attack chains involve compounding vulnerabilities

Featured projects

Security tools I've built — not just followed along with

Six picks from 20+ repositories, chosen because a hiring manager asked "what can he actually do?" These are the answer.

Python · Scapy · FastAPI · Next.js

SentinelSight ↗

Network intelligence and traceroute analysis platform with interactive visualisations. Built during my CodeAlpha internship to make network paths — and the anomalies in them — visible at a glance.

Network Intelligence · Visualisation

Ruby · Android Security

The MPF — Mobile Penetration Testing Framework ↗

A Metasploit-inspired security validation platform for Android app security assessment, built to close gaps I kept hitting in mobile testing workflows.

Mobile Security · Pentesting

Wireshark · tcpdump · PCAP Analysis

Wireshark Forensics Practice ↗

Five network forensic labs analysing real PCAPs — MitM attacks, data exfiltration, and compromised Windows hosts. The lab work behind several of my Medium write-ups.

Forensics · Network Analysis

Python · Packet Analysis

SniffWave — Network Sniffer

A packet sniffer that captures, parses and analyses network traffic for protocol and packet inspection — the small, sharp tool I reach for before opening a full forensic suite.

Network Traffic · Protocol Inspection

Security Awareness · Social Engineering

Phishing Awareness Training ↗

A training module that teaches users to spot phishing, fake websites, email scams and social-engineering tactics. Because the human layer is still where most incidents start.

Awareness · Phishing · Training

Toolkit

Skills, grouped the way SOC job descriptions group them

SIEM & Monitoring

Splunk (SPL2), ELK Stack, ManageEngine Log360, Wazuh EDR, Wireshark, Sysmon, Sophos Firewall

Defensive Operations

Incident Response, Threat Hunting, Log Analysis, Digital Forensics, Alert Triage

Offensive Security

Red Teaming, Penetration Testing, Metasploit, Nmap, Burp Suite, GDB, strace

Frameworks

MITRE ATT&CK, NIST 800-53, CIS Benchmarks, YARA Rules, SOC 2 basics

Languages

Python, Bash, SQL, C, Java, JavaScript, TypeScript

Platforms & Tools

Linux, Windows, AWS, Azure, Docker, Git

Certifications

Credentials, with who issued them

CRTA

Certified Red Team Analyst — CyberWayLabs

BelkaGPT

Digital Forensics — Belkasoft

Endpoint Security

Cisco

Palo Alto Fundamentals

Network Security · Security Operations · Cloud Security

Intro to SPL2

Splunk

Defensive Security & Cyber Risk

Cybrary

Forensics — LetsDefend

NTFS Forensics · TeamViewer Forensics

Certified Ethereum Learner

HackQuest

On my roadmap

CEH v12, then OSCP — goals I'm working towards, not credentials I hold yet.

Writing

I write up what I investigate

Published on Medium in InfoSec Write-ups, MeetCyber and OSINT Team. Writing is how I prove I understood an incident — and how other analysts learn from it.

Contact

Hiring for a SOC or security analyst role?

I'd genuinely like to hear from you. The fastest way to reach me is LinkedIn — I reply to every serious message, usually the same day. I'm based in Vadodara, Gujarat and open to internships and full-time roles, on-site or hybrid here, and remote anywhere.

“Security is not a product, but a process.” — Bruce Schneier, a line I keep on my GitHub for a reason.