Philip O.
United
62 followers
About
I’m an aspiring SOC Analyst and cybersecurity enthusiast transitioning into the cybersecurity industry, with a particular interest in defensive security, threat detection and incident investigation.
Alongside my cybersecurity training, I’ve been developing a practical homelab environment to strengthen my technical knowledge and gain hands-on experience.
My projects include PhilSIEM, a personal self taught, self built security monitoring and investigation environment, and an evolving local-first platform designed to explore SOC workflows, security telemetry, digital evidence handling and incident response.
Through these projects, I’ve gained practical exposure to Linux, Python, Wireshark, Nmap, OpenCanary, FastAPI, SQLite and security log analysis.
I’m particularly interested in understanding how threats are detected, how analysts investigate suspicious activity and how security incidents are documented.
My current goal is to secure an entry-level SOC Analyst or Blue Team position where I can continue learning, contribute to a security team and develop my skills.
Learning by building. Developing through investigation. Working towards a career in cybersecurity.
Specialties
- Security Monitoring
- SIEM Engineering
- SOC Analyst
- Threat Detection
- Threat Hunting
Skills
- Security Information and Event Management (SIEM)
- Security Monitoring
- Log Analysis
- Incident Investigation
- Linux
- Python
- fastapi and sqlite
- Opencanary
Experience
-
Cybersecurity Homelab Developer & aspiring SOC Analyst Trainee
Independent Cybersecurity Projects
Aug 2026
United kingdom
Recent posts
I’ve been developing PhilSIEM, my own hands-on cybersecurity project, combining honeypot monitoring, threat intelligence and security event analysis.
The goal is to build a practical environment for detecting suspicious activity, investigating alerts and developing real-world SOC analyst skills.
The project is still evolving, with some exciting developments planned around automated detection and AI-assisted analysis.
🌐 https://philsiem.com
I’d love to hear feedback from fellow cybersecurity professionals, SOC analysts and enthusiasts.
Feel free to take a look and let me know what you think!
#CyberSecurity #PhilSIEM #SOCAnalyst #ThreatIntelligence #BlueTeam #HomeLab #InfoS
🛡️ From Cybersecurity Student to Building My Own SOC Investigation Platform
Introducing PhilSIEM v4 | Cybersecurity Portfolio & Interactive SOC Lab
Over the past several months, I’ve been taking what I learned during my cybersecurity training and putting it into practice through independent, hands-on projects.
What started as an experiment with an OpenCanary honeypot has gradually developed into something much bigger.
Today, I’m sharing my cybersecurity portfolio website:
🌐 https://philsiem.com
🔍 What’s inside PhilSIEM?
🔹 OpenCanary Honeypot: My hands-on security monitoring project, exploring how deception technology can help identify suspicious network activity.
🔹 PhilSIEM Architecture: A documented proposed security monitoring architecture, exploring how different detection and analysis components could work together.
🔹 Interactive SOC Training Lab: A browser-based environment featuring seven simulated cybersecurity investigations, including SSH password guessing, phishing, suspicious outbound connections and privilege escalation.
🔹 Incident Investigation & Reporting: Analyse simulated logs, assess severity, document findings, receive feedback and generate downloadable investigation reports.
🔹 SOC Case Studies: Structured investigations covering evidence analysis, incident classification and recommended defensive actions.
🎯 Why did I build it?
My goal is to become a Junior SOC Analyst.
I wanted to go beyond studying cybersecurity concepts and create something practical that demonstrates how I’m developing my analytical thinking, technical knowledge and investigation skills.
The interactive investigations use simulated data, while my honeypot work reflects my separate hands-on lab experience.
I’m still learning, improving and developing the platform, but that’s precisely the point. Cybersecurity is a field where there’s always something new to understand.
🤝 I’d welcome feedback from the cybersecurity community.
Whether you’re a SOC analyst, security engineer, mentor or fellow learner, I’d genuinely appreciate your thoughts on the website, the investigations and what I could improve.
Take a look:
🌐 https://philsiem.com
Built through curiosity. Developed through practice. Driven by a passion for cybersecurity.
#Cybersecurity #SOCAnalyst #BlueTeam #PhilSIEM #CyberSecurityProjects #ThreatDetection #IncidentResponse #OpenCanary #CybersecurityLearning #JuniorSOCAnalyst
🚨 Something is taking shape behind the scenes…
I’ve been quietly working on a my own independent cybersecurity project that’s evolving well beyond what I originally imagined.
It started with a simple question:
What if I could build my own environment to observe, investigate and better understand cyber threats?
I’m developing my own local-first cybersecurity investigation environment, combining:
🔹 Live honeypot telemetry
🔹 SOC-style alert monitoring and investigations
🔹 Threat intelligence workflows
🔹 Digital evidence collection and SHA-256 verification
🔹 Chain-of-custody tracking and investigation timelines
🔹 AI-inspired security automation concepts
Now, several development phases later, the pieces are beginning to come together nicely.
I’m not ready to reveal everything just yet, but the focus is on practical cybersecurity, real-world SOC workflows and learning by building rather than simply watching tutorials.
No big promises. No flashy claims.
Just curiosity, determination, plenty of troubleshooting and a project I’m genuinely excited about.
More to come. 🛡️
#CyberSecurity #BlueTeam #SOCAnalyst #CyberSecurityProjects #HomeLab #LearningInPublic #ThreatDetection
Aspiring Cybersecurity / SOC Analyst transitioning into the industry following intensive cybersecurity training and hands-on practical study. Developing skills in threat detection, incident investigation, SIEM, networking, log analysis and security monitoring, with practical experience through labs and independent cybersecurity projects like “philSIEM”, my own home built SIEM attached from my main system to a honeypot laptop and integrated into the telegram app on my smartphone to alert me to threats etc especially when I’m out and about and being away from my desk I can still see the threats coming in.
I’m Currently working towards CompTIA Security+ and continuing to develop skills in KQL, SPL and SOC investigation. Bringing extensive previous experience in customer-facing and operational environments, with strong communication, problem-solving and analytical skills. Seeking an SOC Analyst / Cybersecurity Analyst role where I can continue learning while contributing to a security team.
Building PhilSIEM v2: My Own Home Security Monitoring Environment
I’ve been building something I’m calling PhilSIEM v2, a home-based cybersecurity monitoring environment designed to simulate the sort of detection and response workflow you’d find in a SOC.
The idea is simple:
Don’t just build a network. Build a network you can monitor, attack, investigate and defend.
🌐 Internet → Firewalls → Network Segmentation
Different parts of the environment are separated into VLANs for users, servers, endpoints, monitoring and a dedicated honeypot.
🍯 Cowrie Honeypot
I’ve deliberately created an SSH honeypot to attract and capture malicious activity. This allows me to observe things such as scanning, brute-force attempts and attacker behaviour without exposing my real systems.
🛡️ Suricata
Acts as the detection layer, identifying suspicious and potentially malicious network activity.
👁️ Zeek
Provides deeper network visibility and helps answer questions such as:
Who communicated with whom?
When did it happen?
What protocols were involved?
What actually happened during the connection?
📊 Elastic Stack
Logstash collects and processes the data, Elasticsearch stores and indexes it, and Kibana provides dashboards, visualisation and alerting.
👨💻 SOC Analyst
And ultimately, that’s where I come in.
The goal isn’t to have technology simply throw alerts at me.
It’s to investigate those alerts, understand what happened, determine the severity, identify potential threats and decide on an appropriate response.
So, in simple terms:
Raw network activity → Detection → Logging → Analysis → Alert → Investigation → Response
That’s what PhilSIEM is about.
I’m building this as a practical way to develop the skills needed for a career in SOC analysis, threat detection and incident response, while creating something I can continuously expand and improve.
Better visibility → Faster detection → Stronger defence.
#CyberSecurity #SOC #SIEM #BlueTeam #ThreatDetection #IncidentResponse #NetworkSecurity #CyberSecurityCareer #HomeLab #Elastic #Suricata #Zeek #Kibana #PhilSIEM