LloydSato

Role Cyber Security Professional

I read what malware actually does, map it to the frameworks defenders already use, and turn the result into decisions a business can act on.

Open a channel Read the case files

Status: Available
Base: London, UK
Credentials: MSc Cyber & Forensics · Security+ · IBM CA
In progress: CREST Incident Response

T1055 process injection T1562.001 impair defenses: AMSI Status monitoring 24/7 CVSS risk-led remediation T1027 obfuscated files SIEM splunk · sentinel · defender IOC extracted & enriched MITRE ATT&CK aligned

Declassified work

All case files

Security work is confidential by default, so these are sanitized: the problem, the method, and what changed. Each exhibit declassifies as you reach it — hover or focus to finish the job.

Classified CF-001Malware research Decoding Malicious Camouflage How three malware families slip past AMSI and EDR — dissected in an isolated lab and mapped to 30 MITRE ATT&CK techniques. Any.RunREMnuxT1562.001 Open file Classified CF-002Detection engineering Mapping Detections to ATT&CK Coverage Turning observed adversary behaviour into a technique coverage map — and using the gaps to decide which detections to build next. MITRE ATT&CKSplunkDefender Open file Classified CF-003Vulnerability management Risk-Led Triage Across an Enterprise Estate Prioritising vulnerabilities with CVSS and threat-intelligence-led criteria, then driving remediation to closure with the teams that own the fix. CVSSNessusRisk acceptance Open file

Background

I specialise in translating technical threats into business advice, managing risk registers, and implementing security frameworks like MITRE ATT&CK. Currently operating as a Security Operations Analyst (SOC L1), handling the full incident lifecycle to minimise operational disruption. Across an enterprise estate I have also driven vulnerability management, prioritising remediation with CVSS and threat-intelligence-led criteria.

I hold a Master of Cyber Security and Forensics from the University of Westminster, and industry certifications including CompTIA Security+ and the IBM Cybersecurity Analyst Professional Certificate — with CREST Incident Response currently in progress.

My focus sits at the intersection of detection engineering and adversary research: reading what malware actually does in memory, mapping it to ATT&CK, and feeding those findings back into the controls that stop the next intrusion.

Working competenciesCurrent

Microsoft Defender for Endpoint and Splunk
Infrastructure scanning with Nessus
Vulnerability management and remediation (CVSS)
Static and dynamic analysis of malware
Python, PowerShell, and SQL

Capability ledger

Strongest first in every row

Everything I work with, grouped the way a job description groups it. One axis: how deep I have taken it.

Production11owned in a live environment
Applied11used in the job, alongside others
Lab2taken apart in a controlled environment

SIEM & endpoint

where the alerts land Case file CF-002

Splunk — production
Defender for Endpoint — production
Microsoft Sentinel — applied
CrowdStrike — applied

Vulnerability & risk

triage, remediation, governance Case file CF-003

Vulnerability management — production
Risk registers — production
Incident response — production
Nessus — applied

Malware analysis

static and dynamic, sandboxed Case file CF-001

Dynamic analysis — production
Any.Run — production
Static analysis — applied
REMnux — applied

Threat intelligence

IoCs, CTI, evasion research

IoC identification — production
CTI reporting — applied
AMSI & EDR evasion — lab

Frameworks & standards

the shared language

MITRE ATT&CK — production
CVSS — production
OWASP — applied
CIS Benchmarks — applied
GDPR — applied

Scripting

automation and tooling

PowerShell — production
Python — applied
SQL — applied
C++ — lab

Credentials MSc Cyber Security & Forensics, University of Westminster · CompTIA Security+ · IBM Cybersecurity Analyst · CREST Incident Response — in progress

Event log

Printable CV

From enterprise SOC operations to academic adversary research and back again.

Dec 2025 — Present

Security Operations Analyst (SOC L1)

Acumen Technix LTD · London, UK

Deployed Microsoft Defender for Endpoint to monitor assets and block complex malware.
Administered and optimised Splunk to detect and triage incidents.
Managed risk registers using SQL to track service impacts, ensuring GDPR alignment.

Defender for EndpointSplunkSQLGDPR

Mar 2024 — Mar 2026

Security Analyst

Tesco Stores Ltd · Lambeth, UK

Evaluated and prioritised vulnerabilities using CVSS and threat-intelligence-led criteria to focus remediation on the highest business risk.
Partnered with cross-functional technology and business teams to drive remediation to closure, managing exceptions through the formal risk-acceptance process.
Supported the group vulnerability-management tooling and bug-bounty programme, applying CVSS, OWASP, CIS Benchmarks, and MITRE.

CVSSOWASPCIS BenchmarksBug bounty

Oct 2023 — Mar 2024

Researcher

University of Westminster · Westminster, UK

Conducted in-depth research into malware evasion techniques.
Performed analysis utilising the Any.Run sandbox to dissect process injection and obfuscation.
Produced actionable cyber threat intelligence reports.

Any.RunREMnuxCTIMITRE ATT&CK

Jul 2021 — Nov 2022

Security Operations Analyst (SOC L1)

HSBC · Gurgaon, India

Analysed security alerts from Microsoft Sentinel and CrowdStrike.
Conducted comprehensive analysis of malware samples to identify Indicators of Compromise.
Developed custom scripts using Python and PowerShell to automate intelligence collection.

SentinelCrowdStrikePythonPowerShell

Open a channel

Open to security roles, research collaboration, and contract work. Send a message and I will reply within 48 hours — or just email me directly; both land in the same place.

mail@lloydsato.com direct Curriculum vitae print / pdf research.lloydsato.com write-ups London, UK 51.5072°N 0.1276°W