ONUCHI KALUAvailable now · Ireland

Hello, I am

OnuchiKalu

SOC Analyst · Detection Engineer · Security Tester

I triage alerts, hunt through logs and write detections that catch real attacks. I test them by attacking my own lab first.

View projects → Get in touch
CrowdStrike NG-SIEM 
// Linux: shell spawned by a web server process
#event_simpleName=ProcessRollup2 event_platform=Lin
| ParentBaseFileName=/^(nginx|apache2|httpd|php-fpm)$/
| FileName=/^(sh|bash|dash|python3?|perl|nc)$/
| groupBy([ComputerName, ParentBaseFileName, CommandLine],
    function=count(as=hits))
| sort(hits, order=desc)

Example detections and lab alerts, written to show how I work.

onuchi@lab:~$ whoami
cyber security graduate. meng first class '26, university of limerick. 18 months as a security tester across five platforms. attacks own active directory lab, then writes the detections. isc2 certified. based in portlaoise, ireland.
crowdstrike falcon •sentinel •splunk •wazuh •kql •defender •mitre att&ck •linux •python •powershell •burp suite •wireshark •azure •entra id

Tech stack

The tools I reach for, and where I have actually used each one.

Tap a card for the detail

Where I have been

Tap a node to open the role.

Selected work

Open a project to see how it works.

A small Active Directory domain with Windows and Linux hosts, Entra ID and Azure. I run real attacker techniques against it, trace every step through the logs in Sentinel, Splunk and Wazuh, and write a rule for anything the SIEM missed. Then I tune out the noise so real alerts stand out.

  • T1087BloodHound enumeration of paths to Domain Admin
  • T1558.003Kerberoasting, caught through Event 4769
  • T1550.002Pass-the-Hash, traced through Events 4624 and 4776
  • TuneSuppressed rules that fired on normal activity
CrowdStrike FalconSentinelSplunkWazuhIDSMITRE ATT&CK

An intrusion detection system for IoT networks where no raw traffic ever leaves a device. Ten simulated clients train locally and send only model weights to a central server, which averages them into one shared detector.

  • TrainEach client learns from its own traffic
  • ShareOnly weights go to the Flower server
  • MergeFedAvg builds the global model each round
PythonPyTorchFlowerFederated learning

CVSS says how bad a flaw could be, not how likely it is to be used. I checked every new CVE and advisory against the platforms in scope and ranked open findings by real-world exploitation, so the riskiest were fixed first.

  • CVSSSeverity of the flaw
  • KEV · EPSSIs it exploited, and how likely next
  • AssetHow much the system matters
  • Re-testEvery fix proven before closing in Jira
CVSSCISA KEVEPSSThreat intelJira

Hand-run security checks and Jira-to-Excel reporting ate hours every release. I replaced them with Python and PowerShell scripts in the CI pipeline, cutting manual effort by 40% and giving managers and clients a regular view of open and closed findings.

  • CollectPull findings and check results automatically
  • ReportOpen and closed findings on a schedule
  • Result40% less manual effort per release
PythonPowerShellBashCI/CDGit

A Python application built end to end, from requirements to release. Records are encrypted at rest, each role sees only what it should, and every access is written to an audit log. I wrote the threat model and tests alongside the code.

  • AES-256Records unreadable without the keys
  • RBACSeparate views for students, staff, admins
  • AuditWho read or changed what, and when
PythonAES-256RBACThreat modelling

Built for the SOC

What a SOC analyst does day to day, and where I have done each part.

Done at work

Monitor and triage alerts

Reviewed Defender alerts, incidents and quarantined phishing mail on platforms serving 10,000+ users.

Done in lab

Build and test detections

Write rules in KQL and SPL, run the attack to prove they fire, then tune out the false positives.

Done in lab

Threat hunting with EDR

Hunted my own attacks through CrowdStrike Falcon telemetry and Windows and Linux host logs.

Done at work

Investigate to root cause

Correlated application and system logs across sources so developers got a confirmed cause, not a guess.

Done at work

Threat intel and OSINT

Tracked CVEs and advisories against CISA KEV and EPSS, and enriched indicators in lab investigations.

Growing now

Forensics and response

Memory and packet forensics through MEng labs and TryHackMe. Incident response is where I want to go deepest.

Achievements

1st

MEng Cybersecurity, First Class

University of Limerick, 2026. Final QCA 3.52 of 4.00.

A1

Top grade on my thesis

Privacy-preserving intrusion detection with federated learning.

CC

ISC2 Certified in Cybersecurity

Certification No. 3081876, 2026. Plus Google Cybersecurity Certificate, 2024.

180+

Validated security findings

Each one reproduced, CVSS-rated and re-tested after the fix.

40%

Less manual effort

From replacing hand-run checks and reports with scripts.

4.48

BSc Computer Science

Second Class Upper, CGPA of 5.00. Final project graded Distinction.

Side quests

What I do around the day job.

Mentoring

Lead volunteer facilitator at Genesys Learnable, marking learners' Juice Shop pen test reports.

Scam spotting

At Tesco Mobile I help people recover from scam texts and SIM swaps, then spot the next one.

TryHackMe

Incident handling, packet forensics and memory forensics rooms to keep my hands sharp.

Awareness training

Ran phishing simulations and awareness sessions so staff knew what to spot and report.

Get in touch

Need someone on the alert queue?

LinkedIn ↗kalu-onuchi-6515061b5
LocationPortlaoise, Co. Laois. Open to Dublin and remote.