🎓 Computer Science and Systems (Licence) at École Polytechnique de Lomé (University of Lomé), oriented toward defensive cybersecurity (Blue Team, SOC engineering & DFIR).
🛠️ I design automated security labs and pipelines (Wazuh, Python, Ansible, Terraform, Docker) to monitor threats and speed up incident response.
📍 Lomé, Togo
🎯 Goal: join a SOC team as an analyst / detection engineer, then pursue a master's degree in cybersecurity.
🛡️ Nyx: a mini-SOC for Togolese SMEs
End-of-degree project built in a pair with Gaël Kpodonou, supervised by Dr Essohanam Djeki. A Python correlation engine with YAML detection rules, an automated SOAR response through the OPNsense API, and a KVM lab with Samba AD, Dolibarr and Kali.
My part: the response module (AbuseIPDB enrichment, remediation through the OPNsense API, timeouts and fallbacks), the unified JSON event schema (validated with my pair) and its conformance tests, the Flask dashboard and the Grafana views, and the analysis of the response results.
Attack scenarios tested: SSH brute force, SMB exfiltration, BEC workstation compromise, web brute force on Dolibarr, malicious file upload.
What it does: the tested scenarios raise critical alerts, and the SOAR module responds automatically by blocking the attacker's address through OPNsense.
Known limits and next steps: no correlation across different IP addresses, no hot reload of rules, and the logs and database are not encrypted. Next steps: syslog over TLS, database encryption and Sigma rule support.
⚙️ mini-soc-iac: a Wazuh SOC as code
A mini-SOC deployed automatically on Docker with Terraform, Ansible and a Makefile, with detection tests for SSH brute force and file-integrity monitoring.
🔎 dfir-lab-journal: my DFIR learning log
Lab setup, methodology notes, Wireshark network analysis and reflections, updated as I progress.
🧪 CyberLab Manager: a VM lab orchestrator
A JavaFX application, built by a team of three, that manages VirtualBox labs for malware analysis and pentesting, with a journal, an audit log and PDF reports.
My part (UI/UX and controller): the three-column FXML interface, the external dark-theme CSS, a single controller as the only link between the UI and the services, asynchronous VM actions, and the feature → develop → main Git workflow.
| Domain | Tools and technologies |
|---|---|
| SOC / SIEM | Wazuh, Grafana, rsyslog, log normalization (unified JSON schema, conformance tests) |
| Web security (CTFs and labs) | Burp Suite, used occasionally in CTFs and labs (picoCTF, TryHackMe, Hack The Box, regional CTFs) |
| DFIR | Wireshark, network analysis, log-based investigation |
| Incident response / SOAR | Python, REST APIs, OPNsense, AbuseIPDB |
| Infrastructure as Code | Terraform, Ansible, Docker, Makefile |
| Virtualization and networking | KVM/QEMU, VirtualBox, GNS3, Linux |
| Development | Python, Java (JavaFX, Maven), Flask, SQL, SQLite |
| Collaboration | Git, GitHub, GitHub Actions (CI/CD) |
Currently exploring: Elastic Stack, Splunk, YARA, MITRE ATT&CK.
- Working through the Blue Cape Security "DFIR Foundations and Techniques" certification (in progress); the upcoming modules cover Splunk. I document my labs in my DFIR journal.
Next goals:
- CyberWarfare Labs courses: Blue Team Fundamentals and Cyber Security Analyst (enrolled)
- Later: Splunk Core Certified User certification
“Convinced that the best defense lies in automation, rigor, and continuous improvement. Always open to discussing SOC engineering, SIEM/SOAR architectures, and DFIR.”