Lloyd Sato
Security operations, vulnerability management, and adversary research.
- Cyber security professional
- London, UK
- mail@lloydsato.com
- www.lloydsato.com
Profile
Cyber security professional specialising in translating technical threats into business advice. Currently a Security Operations Analyst (SOC L1) handling the full incident lifecycle; previously drove risk-led vulnerability management across an enterprise estate. Focus at the intersection of detection engineering and adversary research: reading what malware actually does, mapping it to MITRE ATT&CK, and feeding the findings back into controls.
Experience
-
Dec 2025 to present
Security Operations Analyst (SOC L1)
Acumen Technix LTD, London, UK
- Deployed Microsoft Defender for Endpoint to monitor assets and block complex malware.
- Administered and optimised Splunk to detect and triage incidents.
- Managed risk registers using SQL to track service impacts, ensuring GDPR alignment.
-
Mar 2024 to Mar 2026
Security Analyst
Tesco Stores Ltd, Lambeth, UK
- Evaluated and prioritised vulnerabilities using CVSS and threat-intelligence-led criteria to focus remediation on the highest business risk.
- Partnered with cross-functional technology and business teams to drive remediation to closure, managing exceptions through the formal risk-acceptance process.
- Supported the group vulnerability-management tooling and bug-bounty programme, applying CVSS, OWASP, CIS Benchmarks, and MITRE.
-
Oct 2023 to Mar 2024
Researcher
University of Westminster, Westminster, UK
- Conducted in-depth research into malware evasion techniques (AMSI and EDR).
- Performed analysis utilising the Any.Run sandbox to dissect process injection and obfuscation.
- Produced actionable cyber threat intelligence reports.
-
Jul 2021 to Nov 2022
Security Operations Analyst (SOC L1)
HSBC, Gurgaon, India
- Analysed security alerts from Microsoft Sentinel and CrowdStrike.
- Conducted comprehensive analysis of malware samples to identify Indicators of Compromise.
- Developed custom scripts using Python and PowerShell to automate intelligence collection.
Education and certifications
- MScCyber Security and Forensics University of Westminster
- CertCompTIA Security+ certified
- CertIBM Cybersecurity Analyst professional certificate
- CertCREST Incident Response in progress
Technical skills
- SIEM and EDR
- Splunk, Defender for Endpoint, Sentinel, CrowdStrike
- Malware analysis
- Any.Run, REMnux, static and dynamic analysis
- Vulnerability and risk
- Nessus, CVSS, risk registers, incident response
- Threat intelligence
- IoC identification, CTI reporting, AMSI and EDR evasion research
- Frameworks
- MITRE ATT&CK, OWASP, CIS Benchmarks, GDPR
- Scripting
- PowerShell, Python, SQL, C++
Selected work
- Decoding malicious camouflage www.lloydsato.com/casefiles/malware-evasion/ Malware evasion research
- ATT&CK detection coverage www.lloydsato.com/casefiles/attack-coverage/ Methodology
- Risk-led vulnerability triage www.lloydsato.com/casefiles/vuln-management/ Programme case file
- Research feed research.lloydsato.com Write-ups