┌──(alejandro㉿sec-ops)-[~]
└─$ whoami --verbose

> Name   : Alejandro Zavala Zenteno
> Role   : Jr. Cybersecurity Professional & (soon to be) Computational Systems Engineer
> Cert   : ISC2 Certified in Cybersecurity (CC) · 2026–2029
> Base   : Morelia, Michoacán · Mexico  [UTC-6]
> Focus  : SOC Operations | Detection Engineering | SIEM/XDR | Incident Response
> Status : [ Seeking remote security roles · Open to opportunities ]

┌──(alejandro㉿sec-ops)-[~]
└─$ cat featured_project.md

┌──(alejandro㉿sec-ops)-[~]
└─$ cat currently_running.log

[*] Wazuh SIEM Home Lab ........................ COMPLETE (9/9 phases)
    └─ Custom XML rules deployed ............... 5 rules (100001–100005)
    └─ Detection strategy ...................... Behavioral TTPs (Pyramid of Pain)
    └─ ATT&CK techniques covered ............... T1110 · T1078 · T1548 · T1565 · T1087 · T1082 · T1095
    └─ Active response mechanisms .............. firewall-drop (IP ban) + custom alert script
    └─ IRP integration ......................... TheHive v5 ← Wazuh (custom Python API bridge)
    └─ Triage runbooks published ............... 5 (one per custom rule)
    └─ Agents reporting ........................ Windows + Linux
    └─ SOC dashboard ........................... Custom OpenSearch KPI panel (5 visualizations)

[*] Next objectives ............................ QUEUED
    └─ [ ] ???

┌──(alejandro㉿sec-ops)-[~]
└─$ cat skill_matrix.txt

[ Security Operations ]
  SIEM/XDR      ██████████░  Wazuh · OpenSearch · Custom dashboards · Active response
  Detection Eng ████████░░░  XML rules · Behavioral TTPs · Telemetry analysis · Rule tuning
  Threat Hunt   ████████░░░  FIM · Auth correlation · Discovery · C2 detection
  Incident Resp ████████░░░  TheHive v5 · Triage runbooks · Containment SOPs · Kill chain analysis
  Frameworks    ███████░░░░  MITRE ATT&CK · NIST CSF · ISO/IEC 27001 (via ISC2 CC)

[ Infrastructure ]
  Linux         █████████░░  Ubuntu hardening · Debian · Bash scripting · syslog pipelines
  Containers    ████████░░░  Docker · Docker Compose · WSL2 · IaC credential management
  Windows       ██████░░░░░  PowerShell · WazuhSvc · AD basics

[ Networking ]
  Protocols     ███████░░░░  TCP/IP · DNS · SSH · VPN (Sophos)
  Hardware      ██████░░░░░  Cisco · Ruckus · Switches · Routers
  Analysis      ██████░░░░░  Wireshark · Nmap · Firewall config · iptables

[ Offensive (lab only) ]
  Tools         ██████░░░░░  Hydra · Nmap · Nikto · Metasploit · Kali · Reverse shells

┌──(alejandro㉿sec-ops)-[~]
└─$ ls -la projects/

drwxr-xr-x  wazuh-soc-homelab/
│
├── Phase 1 · Stack deployment & credential hardening     [✓ DONE]
├── Phase 2 · Windows agent & lifecycle management        [✓ DONE]
├── Phase 3 · Linux agent & SSH brute-force simulation    [✓ DONE]
│            └─ 1,815 auth failures · Level 10 alert triggered
├── Phase 4 · File Integrity Monitoring (FIM)             [✓ DONE]
│            └─ /etc/passwd tampering · Rules 554 & 550
├── Phase 5 · Custom detection engineering & rule tuning  [✓ DONE]
│            └─ Rules 100001–100005 · Pyramid of Pain shift
│            └─ bash_audit pipeline · Behavioral TTP detection
├── Phase 6 · MITRE ATT&CK mapping & standardization     [✓ DONE]
│            └─ 7 techniques mapped · 5 triage runbooks
├── Phase 7 · Custom SOC dashboard engineering            [✓ DONE]
│            └─ 5 KPI visualizations · OpenSearch bypass
├── Phase 8 · Active response & automated containment     [✓ DONE]
│            └─ firewall-drop IP ban · <2s detection-to-block
│            └─ 3 WSL2 architectural discoveries resolved
└── Phase 9 · TheHive IRP integration & API automation    [✓ DONE]
             └─ Custom Python API bridge · RBAC config
             └─ I/O race condition resolved · 100% alert delivery

┌──(alejandro㉿sec-ops)-[~]
└─$ cat /etc/motd

"The goal is not to be better than everyone else,
 but to be better than you were yesterday."

Building in public · Documenting every step · Failing forward.