Nikola M.
München, Germany · SOC / Security Analyst | Detection Engineering, Malware Analysis, Windows Internals | SC-200 · BTL1 · BTLO Top 1%
Stana Milanovic School of Economics
5 followers
About
After several years working full-time in hospitality, I deliberately transitioned into cybersecurity in early 2025. My focus has been on understanding how operating systems and networks function, how malware abuses them, and how to detect that activity through logs and telemetry.
Over the past 16 months, I:
- Earned Blue Team Level 1 (BTL1) and Microsoft SC-200 certifications
- Completed 90+ blue-team labs on BTLO and TryHackMe (Top 1% worldwide on BTLO, ~2,130 pts)
- Built a Microsoft Sentinel → Velociraptor lab to develop and validate KQL detections with automated host remediation
- Created a FlareVM malware analysis lab and analyzed families including AgentTesla, PulsarRAT, SnakeKeylogger, and WannaCry
- Built a custom Windows EDR prototype in C/C++ that detects in-memory process injection across kernel callbacks and user-mode hooks; validated against real malware including a sample that bypassed Microsoft Defender at time of testing
- Configured an OpenVAS/GVM vulnerability management workflow
I am particularly interested in SOC operations, detection engineering, and Windows-focused malware analysis. Open to connecting with other defenders and opportunities in junior security roles.
Skills
- Malware Analysis
- Security Information and Event Management (SIEM)
- Incident Detection & Triage
- Windows Security
- Azure
- Microsoft Sentinel
- SOC
- KQL
- MITRE ATT&CK
- Detection Engineering
28 skills in total
Licenses & Certifications
-
Blue Team Level 1
Security Blue Team
Issued May 2025
-
Microsoft Certified: Security Operations Analyst Associate
Pending verification
Microsoft
Issued Jul 2025 · Expires Jul 2026
Experience
-
Security Analyst (Home Lab / Independent Projects)
https://github.com/Oligo12/cyber-projects
Dec 2024 — Dec 2024
Education
-
Stana Milanovic School of Economics
HIGH_SCHOOL
Aug 2015 — May 2019
Recent posts
A repost from LinkedIn but:
I recently pushed v1 of a Windows EDR prototype I built in C/C++.
Kernel callbacks + user-mode hook DLL feeding a userland detection engine. Detects three in-memory injection techniques: process hollowing, shellcode remote thread, and image-based injection.
Validated against real malware, including a sample that bypassed Microsoft Defender at time of testing.
Architecture, detection logic, evidence, and known limitations are documented in the repo:
https://github.com/Oligo12/cyber-projects/tree/main/edr-project