Andrew WójciakSOC Analyst & Cybersecurity Specialist
 Email me

I find the fault, whether it's on a board or in a log.

SOC analyst with 20+ years of component-level hardware diagnostics. I triage alerts in Sentinel and Wazuh, write detections in KQL, and test networks with Nmap, Metasploit and Burp Suite.

Open to SOC and security roles in Ireland and remote

Email me See my lab projects
20+
years of board-level diagnostics
5,000+
motherboards repaired
8
credentials: 5 core, 3 stack
5
hands-on security projects
J1U1R7C3 AW-SOC REV C SOC LOG TRIAGE
09:14:02sysmonEID 1 powershell.exe -enc JABz...
09:14:03wazuhlevel 12: encoded command
09:14:03sentinelmapped to T1059.001
09:14:05triagehost isolated, ticket opened

Illustrative alert flow, not real data.

The same four steps, on the bench and in the SOC

Two decades of repairing boards taught me a method that carries straight over to investigating alerts: narrow it down, capture the evidence, decode it, then act on what it shows.

  1. Isolate

    Probe the power rails to find which block of the board is dead.

    Scope the alert down to the one host, account and time window involved.

  2. Capture

    Put a logic analyzer or oscilloscope on the bus and record what it really does.

    Collect Sysmon events, syslog and Wireshark captures from the wire.

  3. Decode

    Dump the SPI flash and unpack it with Binwalk to read the firmware.

    Query the telemetry in KQL to turn raw events into a timeline.

  4. Conclude

    Follow the fault tree to the failed component, replace it, retest.

    Map the behavior to MITRE ATT&CK, contain it, and write it up.

Credentials you can verify

Five core certifications from CompTIA and Microsoft, plus three CompTIA stack credentials earned by combining them. Each one is issued as a Credly digital badge.

Core certifications

PenTest+
CompTIA PenTest+2026
CySA+
CompTIA CySA+2025
Sec+
CompTIA Security+2025
AZ-900
Microsoft Azure Fundamentals2025
Net+
CompTIA Network+2024

Stack credentials

Security++CySA+=CSAPSecurity Analytics Professional
Security++Network+=CNSPNetwork Security Professional
CySA++PenTest+=CNVPNetwork Vulnerability Assessment Professional

See all badges and verification records on Credly

What I work with

SOC and SIEM
Microsoft SentinelWazuhSplunkKQLSysmonLinux syslogMITRE ATT&CKAlert triage
Penetration testing
NmapMetasploitBurp SuiteKali LinuxCVSS scoringVulnerability reporting
Network and identity defense
WiresharkFirewalls and VPNVLAN segmentationDNS, DHCP, TLSActive DirectoryGroup PolicyKerberosZero Trust
Cloud security
AzureMicrosoft Entra IDRBACMFANetwork security groups
Systems and scripting
Linux: Ubuntu, Debian, KaliWindows ServerPythonBashPowerShellPatch management
Hardware security
UARTSPI flash and EEPROMJTAGBinwalkLogic analyzersOscilloscopesMicro-soldering

Lab projects

Five hands-on builds that show how I detect, test, extract, harden and report.

Celtic Shield: SME security and regulatory risk platform

A self-hosted platform I'm building that scans an organization's external attack surface and turns the results into plain-English fixes and regulatory risk for Irish and EU small businesses. It runs with its own internal SOC. Work in progress.

  • Checks the external perimeter: TLS configuration, open ports and publicly exposed cloud storage.
  • Explains each finding in plain English and ranks the fixes, with a ready-to-use task brief for the IT team.
  • Relates findings to NIS2, GDPR and DORA exposure, so owners see the regulatory risk as well as the technical one.
  • Self-hosted end to end, monitored by a SOC I built for it.
Attack surface scanningTLSOpen portsCloud exposureNIS2GDPRDORAInternal SOC

Visit celticshield.online

TLSOpen portsCloud buckets Scanengine Ranked fixes Each fix comes with a plain-English explanation and an IT task brief.

Simplified diagram of the scan-to-fix flow. Findings are related to NIS2, GDPR and DORA exposure.

Enterprise SIEM and threat intelligence lab

A small SOC pipeline: Windows and Linux telemetry flows into Wazuh and Microsoft Sentinel, where detections turn it into mapped alerts.

  • Configured Sysmon to capture process creation, network connections and driver loads.
  • Wrote KQL queries in Sentinel to detect privilege escalation and brute-force attempts.
  • Mapped alert signatures to MITRE ATT&CK to measure defensive coverage.
  • Verified outbound beaconing and lateral movement alerts in Wireshark.
SentinelWazuhSplunkKQLSysmon
Windows+ Sysmon Linuxsyslog Wazuh SentinelKQL rules ATT&CKcoverage 
// Sample brute-force detection
SecurityEvent
| where EventID == 4625
| summarize failures = count()
    by Account, IpAddress, bin(TimeGenerated, 5m)
| where failures >= 10

IoT firmware extraction and analysis

Physical extraction of an embedded device's firmware to find hardcoded credentials, insecure services and outdated packages.

  • Soldered flying leads to board test points and opened a UART serial console.
  • Read the SPI flash chip directly with a hardware programmer.
  • Unpacked the dump with Binwalk and inspected the file system and startup scripts.
  • Found plain-text credentials and outdated daemon services in the root file system.
UARTSPI flashBinwalkLogic analyzer
25-series SPI flash 1 CS#2 DO3 WP#4 GND 8 VCC7 HOLD#6 CLK5 DI Standard SOIC-8 pinout. Flying leads clip to these pins. 
binwalk -e dump.bin
# unpack the file system, then audit
grep -ri "password" _dump.bin.extracted/

Vulnerability assessment and pen testing pipeline

A repeatable method for scanning a simulated corporate network, validating findings, and reporting them by risk.

  • Ran multi-phase Nmap scans with NSE scripts to find misconfigured services and open ports.
  • Validated critical CVEs with Metasploit modules in an isolated lab network.
  • Tested web apps with Burp Suite for injection flaws and broken authentication.
  • Wrote executive and technical reports prioritized by CVSS score.
NmapMetasploitBurp SuitePythonCVSS
NmapMetasploitBurp SuiteCVSS report CVSS v3 severity bands LowMediumHighCritical 0.14.07.09.010 
nmap -sV -sC --script vuln -oA scan 10.0.0.0/24

Active Directory hardening and zero-trust design

A hardened Windows Server domain built around least privilege, to stop credential theft and lateral movement.

  • Set up a tiered admin model (Tier 0, 1, 2) so domain admin credentials never touch lower tiers.
  • Used Group Policy to disable LLMNR and NetBIOS and to require SMB signing.
  • Hardened Kerberos policies and protected privileged service accounts.
  • Enforced VLAN segmentation and MFA on remote access.
Active DirectoryGroup PolicyKerberosVLANsMFA
Tier 0Tier 1Tier 2 Domain controllers, identityServers and applicationsUser workstations No Tier 0 logons below 
# Group Policy: block name-resolution poisoning
LLMNR    disabled
NetBIOS  disabled
SMB signing  required

More code and write-ups on GitHub.

Experience

Recent roles in hardware diagnostics and IT support, built on a technical career that started in 1999.

  1. 2023 to nowWaterford, Ireland

    Senior Electronics and Hardware Diagnostics Engineer

    Device Care

    Lead diagnostic specialist for chip-level board repair, fault-tree analysis and firmware restoration across modern endpoints and enterprise hardware.

    • Does microscope-guided SMD micro-soldering and component replacement down to 0201 packages.
    • Diagnoses power rail shorts, signal integrity faults and corrupted bootloaders with logic analyzers and oscilloscopes.
    • Protects customer data through storage sanitization and hardware integrity checks.
  2. 2022 to 2023Waterford, Ireland

    Technical Support Specialist (work placement)

    Children's Group Link

    Handled systems administration, workstation deployment and endpoint security for a community organization.

    • Built secure workstation images, patch schedules and automated antivirus updates.
    • Trained staff on phishing prevention and password security.
    • Maintained connectivity, user accounts and local backup checks.
  3. 2011 to 2021Waterford, Ireland

    Lead Electronics and Systems Repair Engineer

    Express Repair & GSM Center / PhoneCare

    Ten years leading board diagnostics, firmware flashing and EEPROM reprogramming in the South East of Ireland.

    • Recovered corrupted firmware with JTAG and ISP direct memory readouts and debugged baseband faults.
    • Repaired over 5,000 motherboards, communication devices and computers.
    • Trained junior technicians in high-density PCB soldering, schematic reading and safety.
  4. 1999 to 2011Poland and Dublin

    Earlier career in electronics and hardware engineering

    FM Mobiles (Dublin, 2006 to 2011), Infotel (Poland, 2003 to 2006), GEX (Poland, 1999 to 2003)

    Hardware assembly, Novell and Windows NT server administration, telecoms diagnostics and circuit board repair. This is where the fundamentals in analog and digital electronics and computer architecture came from.

Hiring for a SOC or security role?

I'm available in Ireland and remotely. The quickest way to reach me is email.

PGP public key for encrypted email 
-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEapbWWRYJKwYBBAHaRw8BAQdAYG7EzEfyuY7njTnrXfamVSoIGpPvGmNCZWbr
WgCaxDW0JUFuZHJldyBXb2pjaWFrIDxkcmV3b2pjaWFrQGdtYWlsLmNvbT6IkAQT
FgoAOBYhBMsZ66Cx5SQqnMygmKtuNskBOCbJBQJqltZZAhsDBQsJCAcCBhUKCQgL
AgQWAgMBAh4BAheAAAoJEKtuNskBOCbJ3UgA/3jO9izmx8TtLywamC+pt/1ET8l3
h+vDntd2XpxC2zaEAP40EEue/ziDrrkRRCsQx+AM1UMM+4+NlFbuRO+i4Q7uArg4
BGqW1lkSCisGAQQBl1UBBQEBB0B/2e8nV11Wzlw0vuQqVDxq0G8RoHlnBKuVxnvn
PcwNSQMBCAeIeAQYFgoAIBYhBMsZ66Cx5SQqnMygmKtuNskBOCbJBQJqltZZAhsM
AAoJEKtuNskBOCbJxOsA/A0BUi6WyUUeqxl4+rgrp62RjfGxJEQgLY1Dt4Ip9JoP
AP4vQgJnFbwLNm8I9RhnaxlHtZfJa0CIVqXdjFxva8q3CA==
=v00h
-----END PGP PUBLIC KEY BLOCK-----