SOC · Blue Team · Security Operations

SaheerKhan

Aspiring SOC Analyst · Blue Team
Fresher seeking SOC Analyst L1 roles · Wazuh, Splunk, Burp Suite, Nmap · open to Bengaluru, Kochi and across India.

▸ Security monitoring & SIEM
▸ Incident investigation
▸Detection rule analysis & alert triage
▸ Web & API security testing
View ProjectsGitHubResume
Featured Lab

Wazuh SIEM Home Lab

kali-linux:~/wazuh-docker
WAZUH SIEM
Centralized Security Monitoring & Telemetry
Endpoint VM→
Wazuh Agent→
Wazuh Manager→
Alert Triage→
Investigation

Wazuh SIEM Home Lab

Blue Team · Security Operations

Building a local SIEM environment on Kali Linux to explore centralized security monitoring, endpoint telemetry collection, alert investigation workflows, and detection rule analysis in an isolated Docker environment.

Detection Scenarios & Scope

  • ▸Authentication telemetry & brute force / failed login detection
  • ▸Suspicious process execution inspection and detection rule analysis
  • ▸File Integrity Monitoring (FIM) on sensitive system binaries and configs
  • ▸Privilege escalation and administrative activity monitoring
  • ▸Structured alert triage workflow: timestamp, source, rule ID, and evidence capture
WazuhDockerKali LinuxSIEMLog AnalysisAlert TriageFIM
4
Detection Scenarios
Wazuh
SIEM Engine
Docker
Containerized
View Case Study→GitHub
Projects

Security Projects

Security · CTF Challenge · Web Exploitation

The Ringmaster's Ledger

Hard (500 pts) multi-stage CTF challenge featuring JWT JWK (jku) injection, role-based privilege escalation, SSRF through internal microservices, and sealed ledger credential discovery.

PythonFlaskDockerJWTSSRFNginxRedis
Repo →
Security · Vulnerability Scanner

VulnScan

Web application vulnerability scanner detecting SQL injection, reflected XSS, and missing security headers with risk scoring (0–100) and an interactive Chart.js dashboard.

PythonFlaskBeautifulSoupChart.jsWeb Security
Repo →
Security · API Security · Lab in Progress

API Security Lab (crAPI)

Hands-on API security testing using crAPI in Docker. Focuses on BOLA/BFLA, authorization flaws, excessive data exposure, and business logic weaknesses using Burp Suite. Authorized lab environment only.

DockerBurp SuitecrAPIOWASP API Top 10
Lab in progress

Other Builds

Other Builds · Autonomous AI Operating System

FRIDAY

Multi-agent AI assistant with semantic memory, local vector retrieval, tool orchestration, provider routing, autonomous workflows, and cloud deployment.

ReactTypeScriptPythonRAGDockerCloudflare
Live Site →
Other Builds · Interactive Learning Platform

ZeroLogic

Mobile-first Python learning platform with interactive lessons, code playground, progress tracking, analytics, and Supabase-powered authentication.

ReactSupabaseViteMonaco Editor
Live Site →
Other Builds · Client Business Website

UV Sign

High-contrast mobile-first website for a UV printing company in Kozhikode, Kerala — designed to generate client leads and showcase commercial signage services.

HTML5CSS3JavaScriptSEO
Live Site →
Other Builds · Internship · Contributed Work

Carevia Foundation

Contributed to a platform for a Section 8 NGO focused on empowering women and improving healthcare access. Web development internship at Connectfor. [confirm role, dates, and what I personally built for Carevia].

HTML/CSSJavaScript
Live Site →
Expertise

Core Technical Stack

Security Monitoring & Blue Team

Wazuh SIEMSplunk (SPL)Log AnalysisAlert TriageEndpoint MonitoringIncident InvestigationDetection Rules

Web & API Security

Burp SuiteSQL InjectionOWASP Top 10API TestingAccess Control TestingHTTP Analysis

Reconnaissance & Assessment

NmapNucleiGobusterdirsearchVulnerability Validation

Systems & Infrastructure

Kali LinuxDockerTCP/IP & NetworkingPythonGit & GitHubLinux Administration
Security Operations

Cybersecurity Labs & Practice

Hands-on practice in Blue Team operations, centralized SIEM monitoring, web and API security testing, and reproducible CTF engineering.

All security testing is performed only in authorized lab environments.

Wazuh SIEM Operations

Blue Team · Telemetry

Wazuh Docker deployment on Kali Linux
Endpoint agent onboarding & telemetry collection
Alert triage & log investigation workflows
Detection rule evaluation for failed logins & FIM
SIEM concepts alongside Splunk (SPL) in the institutional lab
Status: Lab in progressKali · Docker · Wazuh

Institutional SOC Lab: Splunk & Wazuh

Security Monitoring

SPL searches and security log review
Alert-investigation exercises
Understanding escalation workflows
Wazuh SIEM practice alongside Splunk
Training-lab experience, not paid SOC employment
Status: Completed exercisesSplunk · Wazuh

Web & API Security (crAPI)

Vulnerability Assessment

crAPI lab environment deployed in Docker
HTTP/S traffic analysis using Burp Suite
Testing BOLA, BFLA & broken object authorization
Excessive data exposure & logic flaws
Evidence-backed findings documentation
Status: Lab TestingBurp Suite · Docker

Recon & Vulnerability Review

Network & Web Scanning

Nmap service discovery & port mapping
Nuclei template execution against lab targets
Content discovery with Gobuster & dirsearch
Manual validation to filter scanner false positives
Documenting affected endpoints & remediation
Approach: Manual VerificationNmap · Nuclei

CTF Challenge Development

The Ringmaster's Ledger

Designed 500-pt hard web exploitation challenge
7-step exploit chain with JWT JWK (jku) flaw
Role escalation, internal SSRF & credential leak
Dockerized multi-container architecture with Nginx
Includes solution guide, tests & automated verification
View Repo →Python · Docker · Nginx

Security Practice & Platforms

THM · HTB · PortSwigger

TryHackMe: SOC Level 1 learning path (status TODO)
TryHackMe: Jr. Penetration Tester learning path (status TODO)
Hack The Box: Active machines & privilege escalation (status TODO)
PortSwigger Web Security Academy: Access control & SQLi (status TODO)
Systematic note-taking & write-up documentation
Active LearningAuthorized Labs

Training & Certifications

Credentials (links TODO)

None currently verified — add after confirming against your resume.

Add completion status and credential links (Offenso, EC-Council, IBM) once verified.

CredentialsSecurity & Cloud
Open Source

GitHub & Technical Activity

Contribution Activity

Saheer Khan's GitHub contribution graph
Writing

Technical Writing

Thoughts on security tooling, SIEM operations, AI infrastructure, and systems engineering.

2026-02-20·12 min read·Security

Web Vulnerability Scanning with Python

Building a modular vulnerability scanner in Python — from crawlers and fingerprinting to SQL injection detection and report generation.

2026-02-05·6 min read·Security

My TryHackMe Workflow for CTF Challenges

The methodology, tools, and mindset I use to systematically solve TryHackMe rooms and capture flags efficiently.

2026-04-15·8 min read·AI/Engineering

Building an AI Assistant with Semantic Memory

How I built FRIDAY's memory architecture using vector embeddings, local RAG, and semantic search for persistent context across sessions.

2026-03-28·10 min read·AI/Engineering

Groq vs Cerebras: AI Inference Performance Testing

Benchmarking latency and throughput between Groq's LPU and Cerebras's Wafer-Scale Engine for LLM inference.

2026-03-10·7 min read·AI/Engineering

Dockerizing Autonomous AI Agents

A practical guide to containerizing multi-agent AI systems with Docker, ensuring isolation, scalability, and reproducible deployments.

2026-01-18·9 min read·AI/Engineering

RAG Architecture: A Practical Explanation

Breaking down Retrieval-Augmented Generation — from document chunking and embedding to vector search and LLM context injection.

Journey

Engineering Timeline

2023

Built first production website

Web Development

Built my first production website using HTML, CSS, and JavaScript with responsive design. [confirm this claim]

HTML/CSSJavaScriptResponsive
2024

Web development internship at Connectfor

Web Development · 1 month

Web development internship at Connectfor (one word). Dates and deliverables [confirm exact dates and what I personally built].

ConnectforInternshipWeb Development
2025

Built FRIDAY and VulnScan; started cybersecurity lab practice

AI Engineering & Cybersecurity

Built FRIDAY (multi-agent AI assistant) and VulnScan (web vulnerability scanner). Began cybersecurity lab practice with Wazuh and web/API security testing.

AI/LLMPythonVulnScanCybersecurity Lab
2026

Targeting SOC Analyst L1 roles

Current Focus

Completed BCA (Data Science) at Acharya Institute of Graduate Studies, Bengaluru (graduation 2026). Offenso cybersecurity training (status/dates TODO). Wazuh home lab and institutional Splunk & Wazuh lab practice. Targeting SOC Analyst L1, Security Operations Associate, and Junior Security Analyst roles in India.

SOC AnalystSIEMWazuhSplunkBlue Team
Contact

Let's work together.

Open to SOC Analyst L1 roles, security internships, freelance projects, or just a good conversation about cybersecurity. Based in Kerala, India · open to Bengaluru, Kochi and across India.

Email

khansaheer424@gmail.com

Phone

+91 97785 50480

LinkedIn

Connect with me

GitHub

View my code