Skip to content
View philipzangara's full-sized avatar

Block or report philipzangara

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
philipzangara/README.md

Philip Zangara

SOC Analyst · Threat Analyst · Detection Engineering

LinkedIn Website GitHub followers


About Me

Cybersecurity professional specializing in threat detection, SIEM engineering, and security workflow automation. My work spans blue-team operations, detection rule development, and threat intelligence with hands-on experience across Splunk, Sigma, Suricata, and MITRE ATT&CK.

I build detections, not just monitor for them. Projects include Sigma rules converted to Splunk SPL, a CTI dashboard correlating AlienVault OTX against live Sysmon telemetry, and Python tools for phishing triage and IOC enrichment.

Currently seeking roles in detection engineering, SOC analysis, and MDR operations.


🎓 Certifications

Certification Issuer
SecurityX · PenTest+ · CySA+ · Security+ · A+ CompTIA
Splunk Core Certified Power User & Core Certified User Splunk
AWS Cloud Practitioner (CCP) Amazon
Azure Fundamentals (AZ-900) Microsoft
Blue Team Level 1 (BTL1) Security Blue Team

M.S. Cybersecurity & Information Assurance · B.A.S. Cybersecurity


🛠️ Skills & Tools

Blue Team / Defense

Splunk Suricata Wireshark

Infrastructure & Platforms

Linux Raspberry Pi Docker AWS Azure

Scripting & Dev

Python Bash


🚀 Projects

Project Description
🎣 Simple Phishing Analyzer Python-based phishing email analyzer performing automated triage of .eml files
🔍 Simple IOC Lookup Python-based IOC enrichment tool for automated triage of IPs, domains, URLs, and file hashes
🪵 Simple Log Parser Python-based log parser that automatically detects and extracts IOCs from Windows Event XML, Apache, and auth.log files
🔎 Simple PCAP Extractor Python-based PCAP parser for extracting network metadata and HTTP file artifacts from capture files
📋 Sigma Detection Rules Sigma detection rules for common adversary TTPs mapped to MITRE ATT&CK with Splunk SPL conversions
🛡️ Splunk OTX CTI Dashboard Splunk Classic Dashboard correlating AlienVault OTX threat intelligence against live Sysmon telemetry
🔒 Linux Security Monitoring Dashboard Ubuntu 24.04 hardened with DoD STIG V1R1 using OpenSCAP. MITRE ATT&CK mapped detections in Splunk with drift simulation and automated daily compliance scanning
📡 Suricata NIDS on Raspberry Pi + Splunk Deployed Suricata as a home NIDS on a Raspberry Pi 4, visualized alerts via Splunk dashboard
🔊 Suricata ET Noise Analysis Analyzed Emerging Threats ruleset noise on a live home network

Building security tools that answer real questions. Open to roles in threat detection, MDR, and SOC operations.

Pinned Loading

  1. simple-ioc-lookup simple-ioc-lookup Public

    Python CLI tool that detects IOC type and enriches IPs, domains, hashes, and URLs via VirusTotal, AbuseIPDB, and WHOIS lookup.

    Python

  2. simple-phishing-analyzer simple-phishing-analyzer Public

    Python-based phishing email analyzer performing automated triage of .eml files including header analysis, URL enrichment via VirusTotal, attachment hashing with MalwareBazaar, and risk scoring mapp…

    Python

  3. simple-log-parser simple-log-parser Public

    Python CLI tool for parsing and triaging Windows Event, Apache, and auth.log files. Extracts IOCs, flags suspicious patterns, and outputs structured JSON.

    Python

  4. splunk-otx-cti-dashboard splunk-otx-cti-dashboard Public

    Splunk Classic Dashboard visualizing AlienVault OTX threat intelligence correlated against live Sysmon endpoint telemetry. Built for the ECA Cyber Range Splunk Security Dashboard Challenge.

  5. linux-stig-siem-monitoring linux-stig-siem-monitoring Public

    Ubuntu 24.04 hardened with DoD STIG V1R1 using OpenSCAP. Live security event monitoring in Splunk with detections mapped to MITRE ATT&CK. Includes drift simulation and automated daily compliance sc…

    Shell

  6. suricata-nids-raspberry-pi suricata-nids-raspberry-pi Public

    A home network intrusion detection system (NIDS) built on a Raspberry Pi 4B running Ubuntu 25.10, using Suricata with Emerging Threats Open rules, forwarding alerts to Splunk via Universal Forwarde…