Lloyd Sato Open a channel

Cyber security professional / London

Lloyd Sato

I read what malware actually does, map it to ATT&CK, and turn that into decisions a business can act on.

Open a channel Case files
T1055 process injection T1562.001 impair defenses, AMSI CVSS risk-led remediation T1027 obfuscated files SIEM splunk, sentinel, defender IOC extracted and enriched MITRE ATT&CK aligned SOC full incident lifecycle

Security work is confidential by default. What I can show you is the method, and what changed because of it.

What I do

Declassified work

Case files

Security work is confidential, so these are sanitized: the problem, the method, and what changed. Drag or swipe the row, or step through it with the arrows.

MITRE ATT&CK techniques mapped across three malware families

Defense evasion, 9 of 30

CF-001Malware research

Decoding malicious camouflage

How three malware families slip past AMSI and EDR, dissected in an isolated lab and mapped to 30 MITRE ATT&CK techniques.

  • Any.Run
  • REMnux
  • T1562.001
Open file
Techniques observed per ATT&CK tactic, gaps ranked

Defense evasion, 9 techniques

CF-002Detection engineering

Mapping detections to ATT&CK coverage

Turning observed adversary behaviour into a technique coverage map, then using the gaps to decide which detections to build next.

  • MITRE ATT&CK
  • Splunk
  • Defender
Open file
Stages, identified through to closed or accepted

Stage 04, the threat-intelligence overlay

CF-003Vulnerability management

Risk-led triage across an enterprise estate

Prioritising vulnerabilities with CVSS and threat-intelligence-led criteria, then driving remediation to closure with the teams that own the fix.

  • CVSS
  • Nessus
  • Risk acceptance
Open file
All case files

Tools

Where the work needed something that did not exist, I built it. Open source, tested, and clear about its limits.

imgstrip Python, BSD-3-Clause

Photos quietly carry a location, a camera, a time taken, and sometimes more. Most metadata removers delete the tags they recognise and copy the rest of the file across, so anything unrecognised survives. imgstrip works the other way round. It reads only the pixels, writes a brand-new file from them, and checks its own work before it saves anything.

  • Python
  • Pillow
  • NumPy
  • pytest
Look, clean, confirm
$ imgstrip --check holiday.jpg
FOUND    holiday.jpg (JPEG 640x480): 4 item(s)
           [metadata] EXIF: make=NIKON, model=COOLPIX P6000, date=2008:10:22 16:28:39
           [metadata] GPS location: 43.467448, 11.885127
           [hidden]   Embedded EXIF thumbnail: 6702 bytes
           [metadata] XMP: 4000 bytes

$ imgstrip holiday.jpg
cleaned  holiday.jpg -> holiday.clean.jpg
           removed: EXIF, GPS location, Embedded EXIF thumbnail, XMP

$ imgstrip --check holiday.clean.jpg
clean    holiday.clean.jpg (JPEG 640x480)
  1. 01
    Decode

    Only pixel values cross over by default. The metadata, thumbnails and appended data stay behind.

  2. 02
    Rebuild

    A brand-new file is written from those pixels, so there is nothing left to leak.

  3. 03
    Account

    A strict parser must account for every part of the new file.

  4. 04
    Compare

    The file is decoded again and matched to the pixels. If either check fails, nothing is written.

Checks
2Before anything is saved, and failing either one writes nothing
Formats
8JPEG, PNG, WebP, GIF, HEIC and HEIF, AVIF, TIFF and BMP
Interfaces
3Command line, Python library and a local web app, all on one engine

It cleans the file, not the scene: faces, street signs and landmarks in the picture stay, and a clean scan is never claimed as proof. The web app runs on 127.0.0.1, works offline and uploads nothing. The full list of limits is in the README.

Source on GitHub Install from PyPI

Background

I specialise in translating technical threats into business advice, managing risk registers, and implementing security frameworks like MITRE ATT&CK. Currently operating as a Security Operations Analyst (SOC L1), handling the full incident lifecycle to minimise operational disruption. Across an enterprise estate I have also driven vulnerability management, prioritising remediation with CVSS and threat-intelligence-led criteria.

My focus sits at the intersection of detection engineering and adversary research: reading what malware actually does in memory, mapping it to ATT&CK, and feeding those findings back into the controls that stop the next intrusion.

Credentials

  • MScCyber Security and Forensics University of Westminster
  • CertCompTIA Security+ certified
  • CertIBM Cybersecurity Analyst professional certificate
  • CertCREST Incident Response in progress
  • BaseLondon, United Kingdom open to security roles and research collaboration

Capability

Everything I work with, grouped the way a job description groups it. One axis: how deep I have taken it.

SIEM and endpoint

where the alerts land
  • Splunkproduction
  • Defender for Endpointproduction
  • Microsoft Sentinelapplied
  • CrowdStrikeapplied

Case file CF-002

Vulnerability and risk

triage, remediation, governance
  • Vulnerability managementproduction
  • Risk registersproduction
  • Incident responseproduction
  • Nessusapplied

Case file CF-003

Malware analysis

static and dynamic, sandboxed
  • Dynamic analysisproduction
  • Any.Runproduction
  • Static analysisapplied
  • REMnuxapplied

Case file CF-001

Threat intelligence

IoCs, CTI, evasion research
  • IoC identificationproduction
  • CTI reportingapplied
  • AMSI and EDR evasionlab

Research

Frameworks and standards

the shared language
  • MITRE ATT&CKproduction
  • CVSSproduction
  • OWASPapplied
  • CIS Benchmarksapplied
  • GDPRapplied

Scripting

automation and tooling
  • PowerShellproduction
  • Pythonapplied
  • SQLapplied
  • C++lab

Experience

From enterprise SOC operations to academic adversary research and back again.

  1. Dec 2025 to present

    Security Operations Analyst (SOC L1)

    Acumen Technix LTD, London, UK

    • Deployed Microsoft Defender for Endpoint to monitor assets and block complex malware.
    • Administered and optimised Splunk to detect and triage incidents.
    • Managed risk registers using SQL to track service impacts, ensuring GDPR alignment.
    • Defender for Endpoint
    • Splunk
    • SQL
    • GDPR

  2. Mar 2024 to Mar 2026

    Security Analyst

    Tesco Stores Ltd, Lambeth, UK

    • Evaluated and prioritised vulnerabilities using CVSS and threat-intelligence-led criteria to focus remediation on the highest business risk.
    • Partnered with cross-functional technology and business teams to drive remediation to closure, managing exceptions through the formal risk-acceptance process.
    • Supported the group vulnerability-management tooling and bug-bounty programme, applying CVSS, OWASP, CIS Benchmarks, and MITRE.
    • CVSS
    • OWASP
    • CIS Benchmarks
    • Bug bounty

  3. Oct 2023 to Mar 2024

    Researcher

    University of Westminster, Westminster, UK

    • Conducted in-depth research into malware evasion techniques.
    • Performed analysis utilising the Any.Run sandbox to dissect process injection and obfuscation.
    • Produced actionable cyber threat intelligence reports.
    • Any.Run
    • REMnux
    • CTI
    • MITRE ATT&CK

  4. Jul 2021 to Nov 2022

    Security Operations Analyst (SOC L1)

    HSBC, Gurgaon, India

    • Analysed security alerts from Microsoft Sentinel and CrowdStrike.
    • Conducted comprehensive analysis of malware samples to identify Indicators of Compromise.
    • Developed custom scripts using Python and PowerShell to automate intelligence collection.
    • Sentinel
    • CrowdStrike
    • Python
    • PowerShell

Open to security roles, research collaboration, and contract work

Open a channel

Send a message and I will reply within 48 hours, or email me directly. Both land in the same place.

Ready