About Projects Case Study Architecture Certifications Connect Contact
LinkedIn GitHub TikTok
Open to SOC & Cloud Security Roles

Mojalefa L. Letsoara

Cybersecurity Analyst with an interest in SOC and cloud security roles, building hands-on capability in Azure security, threat detection and incident response. I build real security environments, investigate the alerts they generate, and document every step.

View Projects Download CV
1000+
Hours Logged
9
Certifications
6+
Case Studies
Tools & Platforms I Work In
Microsoft Sentinel
Splunk
Wazuh
Zeek
Suricata
KQL
Entra ID
Defender for Cloud
Sysmon
MITRE ATT&CK
Bicep
Azure CLI
Right Now

Current focus, currently building

Real, editable status, not a claim that sits still once it's published.

Current Focus
  • SOC Operations
  • Microsoft Security
  • Azure Security
  • Detection Engineering
  • Incident Response
  • Cloud Security
Currently Building
Preparing for the AZ-104 retake and SC-500, studied side by side ahead of back-to-back exams in October.

AZ-104 retake in

Next Milestone
AI-901, targeted for late November or December 2026.
View the full roadmap →
About

I don't just study security.
I build it.

My path into cybersecurity didn't start in a classroom. It started with a need to understand how systems actually break. Reading about attacks wasn't enough, so I set out to stand up the infrastructure, generate the traffic, trigger the alert and walk the investigation myself.

I'd rather spend a weekend building a hybrid Azure lab and chasing down a detection gap than memorise a slide deck about one. Every project here exists because I built it, broke it, monitored it and wrote down what happened. That is the same loop I want to run inside a SOC.

Capabilities

What I bring to a SOC

Four areas I've built practical, evidence-backed depth in.

01

SOC Operations

Alert triage, log correlation and case management with an eye for signal over noise.

  • Alert Triage
  • SIEM
  • Log Correlation
  • Case Management
02

Azure Security

Securing Azure workloads with identity, network and detection controls built end to end.

  • Microsoft Sentinel
  • Entra ID
  • Defender for Cloud
  • Azure Networking
03

Security Investigation

Turning a single alert into a full timeline: root cause, blast radius and remediation.

  • Threat Hunting
  • Kill-Chain Analysis
  • KQL
  • Root Cause Analysis
04

Infrastructure

Designing and running the networks and systems that make detection possible in the first place.

  • Hybrid Cloud
  • Network Design
  • Windows & Linux
  • Virtualization
Featured Projects

Built, monitored, investigated

Five projects, each with the hours actually logged against it. Click any tile for the full detail.

Enterprise Hybrid SOC Lab, Stoneage Logistics

A self-directed SOC build simulating a real security consulting engagement: designing, deploying and defending a hybrid Azure environment for a fictional logistics client, end to end.

Phases 1 to 10 are complete: Azure foundation, Active Directory, Windows and Linux endpoints, Zeek and Suricata network monitoring, Wazuh, Microsoft Sentinel and Splunk Enterprise, all verified with real telemetry flowing through the stack.

The build follows the shape of a real engagement rather than a tutorial: landing zone first, then identity, then endpoints, then the sensors, then the SIEM layer that has to make sense of all of it. Detection engineering, threat hunting and incident response run on top of what the environment actually produces.

  • Bicep
  • Azure CLI
  • Microsoft Sentinel
  • Wazuh
  • Splunk
  • Zeek
  • Suricata
Private repo, request the write-up

Conti Ransomware Investigation

A full SOC investigation into a Conti ransomware compromise of a Microsoft Exchange server.

28,145 events analysed in Splunk 8.2.2 across Windows Security, Sysmon and IIS logs to reconstruct the complete attack chain from raw log evidence.

The trail ran from initial exploitation of three CVEs through to a trojanised cmd.exe planted for persistence, which is how the attacker kept access after the vulnerabilities were patched. Written up as a 24-page technical report with 24 annotated screenshots.

  • Splunk
  • Log Correlation
  • Incident Response
  • Sysmon
View on GitHub

Threat Detection & Log Analysis

A Tier 1 SOC investigation simulation built on Apache access logs in Splunk.

112 Apache access logs ingested into Splunk and analysed with 9 custom SPL queries to identify suspicious HTTP behaviour and botnet-style traffic patterns.

The work is documented as a formal incident report: what was searched, what the results meant, and which patterns separated ordinary traffic from automated abuse. Eight days logged, the largest single time investment of any project here.

  • Splunk
  • SPL
  • Log Analysis
  • HTTP Forensics
View on GitHub

Legacy Account Recovery, ATO Case Study

A SOC case study on identity-based attacks, inspired by the 2013 iCloud breach.

The study maps a full account-takeover attack chain to MITRE ATT&CK and NIST, phase by phase, then writes a SOC detection rule for each phase rather than stopping at the description of the attack.

The point was to practise the translation step: taking a documented historical breach and turning it into something a SOC could actually alert on today.

  • MITRE ATT&CK
  • NIST
  • Identity Security
  • Threat Modeling
View on GitHub

Enterprise SOC Portfolio

A ten-project roadmap building toward a full enterprise SOC simulation.

Microsoft Sentinel, Defender XDR, KQL threat hunting, SOAR automation and Entra ID identity investigation, built as evidence-backed SC-200 and SC-300 preparation rather than exam cramming.

Project 01 in the roadmap produced the KQL analytics rule counted in the detection-rule figure elsewhere on this site.

  • Sentinel
  • Defender XDR
  • KQL
  • Entra ID
  • SOAR
View on GitHub
All Projects on GitHub
Case Study

When an alert becomes an investigation

ScenarioConti Ransomware, Exchange Compromise
SeverityCritical
EnvironmentMicrosoft Exchange Server
Detection SourceSplunk 8.2.2, 28,145 events
01 · Initial Access
Exchange server exploited

Three CVEs identified as the entry point: CVE-2020-0796 (SMBGhost), CVE-2018-13374 and CVE-2018-13379.

02 · Persistence
Trojanised cmd.exe

A modified cmd.exe was planted to maintain access even after the exploited vulnerabilities were patched.

03 · Correlation
28,145 events reviewed

Windows Security, Sysmon and IIS logs correlated in Splunk to reconstruct the full attack chain.

04 · Mapping
Methodology documented

How the attacker maintained access after patching, mapped step by step from the log evidence.

05 · Reporting
24-page technical report

Findings written up with 24 annotated screenshots supporting every step of the investigation.

The investigation: a full SOC investigation into a Conti ransomware compromise of a Microsoft Exchange server, using Splunk 8.2.2 to analyse 28,145 events across Windows Security, Sysmon and IIS log sources. The trail ran from initial exploitation of three CVEs through to a trojanised cmd.exe used for persistence, reconstructing the complete attack chain from raw log evidence.

The outcome: a 24-page technical report with 24 annotated screenshots documenting the exploited vulnerabilities, the persistence mechanism, and how the attacker maintained access even after the vulnerabilities were patched.

Read the Full Write-Up
Field Notes

What the investigations turned up

"28,145 events across Windows Security, Sysmon and IIS logs reconstructed the full attack chain, from three exploited CVEs to a trojanised cmd.exe planted for persistence."

01
Conti Ransomware Investigation
Splunk 8.2.2 · 24-page report

"112 Apache access logs and 9 custom SPL queries, enough to separate ordinary traffic from botnet-style request patterns and write it up as a formal incident report."

02
Threat Detection & Log Analysis
Splunk SIEM · Tier 1 simulation

"Mapping an account-takeover chain to MITRE ATT&CK and NIST turned a historical breach into a concrete set of SOC detection rules, one for each phase."

03
Legacy Account Recovery
ATO case study · MITRE ATT&CK
Architecture Library

Patterns I design and defend

Seven network architecture patterns documented in my diagram library.

Hub & Spoke
Full Mesh
Transit
DMZ
Multi-Region
Hybrid Cloud
Branch Office
See Library
144+
Hours Across Projects
5+
Detection Rules Written
6+
Documented Case Studies
7
Architecture Patterns

Hours totalled from time actually logged per project at 8 hrs/day. Detection rules: 4 YARA rules from the phishing triage lab plus 1 KQL analytics rule from Enterprise SOC Portfolio Project 01. Case studies and architecture patterns are counted directly from published repos.

Certifications

Formalising the skills

Nine completed, each with a live verification link.

9 Earned
Completed
AZ-900: Azure Fundamentals
Microsoft · Mar 2026
Verify
SC-900: Security, Compliance & Identity Fundamentals
Microsoft · Mar 2026
Verify
SC-200: Security Operations Analyst Associate
Microsoft · Jul 2026
Verify
CompTIA Security+
CompTIA · Jun 2026
Verify
CompTIA CySA+
CompTIA · Jun 2026
Verify
AI Skills Fest 2026
Microsoft · Jun 2026
Verify
Junior Cybersecurity Analyst Career Path
Cisco · Dec 2025
Verify
Cyber Security 101
TryHackMe · Dec 2025
Verify
Pre Security
TryHackMe · Dec 2025
Verify
In Progress
AZ-104: Azure Administrator Associate
Microsoft · Studying now

Deepening the Azure administration side of the SOC picture: identity, networking, storage and governance under the same environments I already monitor.

In Progress
SC-500: Cloud and AI Security Engineer Associate
Microsoft · Booked, 21 Oct 2026

Microsoft's direct replacement for AZ-500, extending Azure security into securing AI workloads and agents. Booked the day after the AZ-104 retake, studied alongside it.

Full Certification History Certification Calendar
Building in Public

I build. I document. I share.

Contact

Send me your query anytime

Hiring for a SOC or cloud security role, or want the write-up on a private lab? Send a message and it lands straight in my inbox.

Get in touch

Let's put this to work in your SOC or cloud team

I'm actively pursuing SOC Analyst and cloud security roles where I can bring this same build, monitor, investigate, document approach to a real production environment.

Download CV Send a Message
Mojalefa L. Letsoara
LinkedIn GitHub TikTok
© 2026 Mojalefa L. Letsoara · Last updated
Open to SOC & Cloud Security Roles