Open to SOC traineeship · Rotterdam, NL

Cybersecurity student building the evidence, lab by lab.

Aspiring SOC analyst focused on defensive security — packet analysis, log investigation and network hardening. Everything here is documented from my own home lab: objective, environment, tools, results.

View my labsView projectsAbout me
Labs documented
14Labs documented
Home-lab builds
3Home-lab builds
Certs in progress
2Certs in progress
Next step
SOCNext step
Jp. Powel, portrait

01 / About

From curiosity about networks to a career in defensive security.

I came into cybersecurity through IT support and networking, where I spent most of my time chasing why traffic did not behave the way it was supposed to. That habit — reading logs until the story makes sense — is what pulled me toward the blue team side.

Right now I am studying network defense, SIEM fundamentals and Linux administration, and I rebuild every concept in my own lab before I claim to know it. My goal is a SOC analyst role where detection engineering and incident response are the daily work.

Outside of study I follow CTFs, disclosure write-ups and security podcasts, and I document what I learn here so progress is visible instead of claimed.

Focus
Defensive security: log analysis, network monitoring, detection and incident response.
Studying
Network security, SIEM operations, Linux hardening, Python and Bash for automation.
Looking for
A SOC traineeship or junior analyst position in the Netherlands, on-site or hybrid.

02 / Cybersecurity labs

Hands-on write-ups, not tool lists

Each lab follows the same structure — objective, environment, tools, what I did, results, what I learned — so the reasoning is reviewable, not just the screenshot.

LAB-01

SYN-flood detection with Wireshark and tcpdump

Network analysis

Objective

Capture a TCP SYN flood against a lab web server and prove it apart from legitimate traffic bursts.

Environment

Kali attacker, Ubuntu Server target and a monitoring VM on an isolated host-only segment.

What I did

Baselined normal traffic, generated the flood, then filtered on half-open connections and compared SYN to SYN-ACK ratios per source.

Results

Isolated the spoofed sources, measured the retransmission pattern and wrote a reusable display filter for triage.

What I learned

Volume alone is not the signal — the handshake asymmetry is. That distinction is what stops a SOC from escalating a marketing campaign as an attack.

Tools

Wiresharktcpdumphping3Ubuntu Server
Terminal output
$ tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0'
14:02:11.884 IP 10.0.0.9.443 > target.80: Flags [S]
14:02:11.884 IP 10.0.0.9.443 > target.80: Flags [S]
... 18,412 SYN / 96 SYN-ACK in 10s
filter: tcp.flags.syn==1 && tcp.flags.ack==0
LAB-02SIEM

First Splunk investigation: failed-logon spike

Objective

Turn a burst of Windows 4625 events into a decision: brute force or misconfigured service account.

What I did

Forwarded event logs, built a search grouping failures by source host and account, then pivoted on the first success after the spike.

Results & takeaway

Saved the search as an alert with a threshold tuned to the baseline.

SplunkWindows Event LogsSPL
LAB-NEW

New lab

03 / Projects

Where the individual skills come together

FlagshipIn progress

SOC Home Lab: end-to-end detection pipeline

A full attack-to-investigation chain I can replay on demand: a simulated attacker on an isolated VLAN, a monitored target, log shipping into a SIEM, saved detections, and a written investigation for each alert that fires.

  1. 01Attacker
  2. 02Network
  3. 03Target
  4. 04Logs
  5. 05SIEM
  6. 06Detection
  7. 07Investigation
Read the build log

Automation

Triage helper scripts

Python and Bash utilities that parse capture summaries and auth logs into a short triage report — the repetitive part of every lab, done once.

PythonBash

Documentation

Detection notebook

A growing set of sanitized detection rules with the log source, the false-positive notes and the analyst steps that follow each alert.

SigmaMITRE ATT&CK

04 / Skills & tools

Organised by domain, honest about level

Networking

  • TCP/IP
  • DNS & DHCP
  • VLANs
  • Firewalls
  • VPN concepts

Operating systems

  • Linux (Debian/Kali)
  • Windows / AD basics
  • Virtualisation

Scripting

  • Pythonlearning
  • Bash
  • PowerShelllearning

Security

  • SIEM operations
  • Log analysis
  • Vulnerability assessment
  • Incident responselearning

Tools

  • Splunk
  • Wireshark
  • Nmap
  • tcpdump
  • pfSense

Certifications & education

Completed
Cybersecurity fundamentals coursework
In progress
CompTIA Security+ · Blue-team labs
Planned
CCNA · Splunk Core User

05 / My cybersecurity journey

Visible progression, one milestone at a time

Each milestone links to the lab or project that proves it.

  1. 2018
    Education2018 — 2022

    International Trade

    Commercial background that sharpened the soft skills a SOC role needs: writing clearly, working with stakeholders, explaining risk to non-technical people.

    5 years
  2. 2019
    Milestone2019

    Started in IT

    Support and troubleshooting — the first taste of reading logs to explain behaviour.

  3. 2020
    Milestone2020

    Networking foundations

    TCP/IP, DNS, DHCP and routing — enough to know what normal traffic looks like.

    TCP/IPDNSDHCP
  4. 2021
    Milestone2021

    Linux administration

    Debian and Kali daily driving, permissions, services, systemd and log locations.

    DebianKalisystemd
  5. 2022
    Milestone2022

    Security fundamentals

    CIA triad, cryptography basics, threat models and the vocabulary of the field.

  6. 2023
    Role2023

    Cybersecurity Intern

    Ecodation

    Researched security practice for organisations: policy, ISO 27001 and GDPR context. Documented Active Directory and workgroup concepts, mapped LAN/WAN/VLAN and VPN topologies, and reviewed firewall rules against documented need.

    ISO 27001GDPRActive Directory
    Milestone2023

    Blue team focus

    Packet and log analysis became the work I wanted to do every day.

    Wiresharktcpdump
    See LAB-01
  7. 2024
    Milestone2024

    Offensive basics for context

    Scanning, ARP poisoning and web attacks — run in the lab so I can recognise them in logs.

    NmapKali
  8. 2025
    Milestone2025

    Home lab build

    Segmented VLANs, a SIEM and log shipping wired together.

    pfSenseSplunkVLANs
    See the project
  9. 2026
    Certification2026 — now

    Certifications in progress

    Security+ and Splunk Core User, studied alongside the lab work rather than instead of it.

    Security+Splunk
    Next2026 — now

    SOC analyst

    A traineeship where detection and response are the job, not the side project.

    Get in touch

06 / Blog

Notes from the lab, not news recaps

All posts →

No posts published yet. The first write-ups land here as the labs are documented.

07 / Resume

Experience, education, courses

2018 — 2022 · Education

International Trade

Commercial background that sharpened the soft skills a SOC role needs: writing clearly, working with stakeholders, explaining risk to non-technical people.

2023 — 2023 · Experience

Cybersecurity Intern

Ecodation

Researched security practice for organisations: policy, ISO 27001 and GDPR context. Documented Active Directory and workgroup concepts, mapped LAN/WAN/VLAN and VPN topologies, and reviewed firewall rules against documented need.

Courses

Cyber Security Essentials
2023
DDoS attacks & mitigation
2024
Network defense & monitoring
2025

08 / Contact

Looking for a SOC traineeship — let's talk

The portfolio has the evidence; I am happy to walk through any lab live and answer questions about how I got there.

Email me