Junior SOC / L1 analyst candidate
Sofia, Bulgaria

15 years of security procedure, now pointed at alerts.

I work in aviation security, where the job is to follow standards, notice what does not fit, and escalate with a clear record. I am moving that discipline into a Security Operations Center, and this page shows the practice I have done so far.

Open to work Hybrid or remote English C1 Security+ exam planned Dec 2026

Hands-on work

Projects

Self-training tool · built with Claude Code · Oct 2026

SOC Night Shift: alert triage simulator

A browser-based SIEM-style simulator I built to practice triage decisions. It streams simulated events from Windows, firewall, VPN, proxy, DNS and EDR sources and raises alerts. For each alert I pick a category (true positive, benign true positive or false positive) and a severity, then write a one-sentence justification with evidence. The app scores the decision, shows what I should have checked, and keeps a journal so I can review my mistakes. It runs locally and the interface is in Bulgarian.

Alert triageWindows, VPN, proxy, DNS, EDR logsLog search and filtersScored decisionsDecision journal

SOC Night Shift simulator: live event stream and open alerts — Live event stream and alert queue

SOC Night Shift simulator feedback on an impossible travel alert resolved as false positive — Feedback on my decision: impossible travel alert, false positive (Zscaler proxy)

Study tool · built with Claude Code · 2026

Security+ trainer

An interactive study app mapped to all 28 sub-objectives of the official CompTIA Security+ SY0-701 exam objectives. It has 94 quiz questions with explanations, 80 flashcards, 25 Socratic questions where I explain a concept in my own words, 10 workplace scenarios set in a fictional company, a 116-term glossary and spaced-repetition review. Progress is tracked per domain and per sub-objective. The interface is in Bulgarian, my native language.

Why "Boev Corp"? Every scenario in the app takes place in one fictional company, named after me. It is a fintech with about 600 employees, a hybrid setup (own data center plus AWS), a remote and hybrid workforce, EU customer data under GDPR, and its own SOC with a small, growing security team. Using one consistent workplace lets me practice each concept the way it appears in a real job, instead of memorizing isolated definitions.

CompTIA SY0-701QuizzesFlashcardsSocratic dialogueSpaced repetitionProgress tracking

Security+ trainer home screen with the five exam domains and progress — Five exam domains

Security+ trainer quiz question about the CIA triad with explanation — Quiz with explanation

Security+ trainer flashcard showing the term CIA Triad — Flashcards

Security+ trainer Socratic question about Zero Trust — Socratic dialogue

Security+ trainer real-world task about preventing tailgating — Workplace scenario

Security+ trainer spaced repetition modes — Spaced repetition

Security+ trainer glossary with 116 terms — Glossary, 116 terms

Security+ trainer progress per domain and sub-objective — Progress per sub-objective

Linux log analysis · sample auth.log · Oct 2026

SSH brute-force analysis

Analyzed a sample Linux auth.log in Ubuntu on WSL using grep, awk, sort and uniq. Findings: 40 failed SSH logins came from three addresses in the same /24 range (16, 14 and 10 attempts), mostly against common account names such as admin, guest, ubuntu, test and oracle. The top address (203.0.113.6, 17 log lines) also has the one accepted login, for user m.dimitrova, at 02:59:10, so the brute force most likely succeeded (MITRE T1110, then T1078). Recommended response: block the range, reset that account's password, review its activity after 02:59:10, and move SSH to key-based login with rate limiting.

grepawksort | uniq -cwc -lMITRE T1110 / T1078

Terminal: grep, awk, sort and uniq counting failed SSH logins per IP, then grep for the accepted login — Failed logins per IP, the accepted login, and total lines for the top address (computer name redacted)

Home lab · Oct 2026

Home network inventory and baseline

Mapped every device on my home network with nmap and arp, matched MAC vendors to real devices, and used controlled power-off tests to explain each unknown address. Result: a documented baseline and a hardening plan for the router.

nmaparpMAC / OUI lookupBaselining

Completed rooms and courses

Learning log

Date	Room	What I practiced
20 Oct 2026	Phishing Analysis Fundamentals	Email headers, SPF/DKIM/DMARC, defanging URLs, safe attachment handling
19 Oct 2026	Cyber Kill Chain	Mapping attacker stages and where defenders can break them
19 Oct 2026	Pyramid of Pain	Why blocking behavior hurts attackers more than blocking hashes or IPs
18 Oct 2026	Introduction to EDR	Process trees, behavioral detection, isolation and response actions
14–15 Oct 2026	SOC Fundamentals · Report Writing for SOC L2	SOC roles and workflow, writing clear incident reports
13 Oct 2026	SOC L1 Alert Triage · SOC L1 Alert Reporting	Prioritizing alerts, deciding true or false positive, reporting findings
Oct 2026	Introduction to SIEM	Log collection, correlation and alerting basics
2026	AI/ML Security Threats	Threats to AI systems; reviewed MITRE ATLAS and ISO/IEC 27090
2026	SOC Role in Blue Team · Junior Security Analyst Intro	SOC career paths and security hierarchy, a day in the life of a security analyst
24 Sep 2026	Linux Administration Bootcamp (Udemy certificate, 9.5 hours)	Linux administration, permissions, processes, log analysis

Evidence: TryHackMe completion screens

Each screen shows 100% room completion on my account. Click an image to enlarge.

TryHackMe Phishing Analysis Fundamentals room completed 100 percent — Phishing Analysis Fundamentals

TryHackMe Cyber Kill Chain room completed 100 percent — Cyber Kill Chain

TryHackMe Pyramid of Pain room completed 100 percent — Pyramid of Pain

TryHackMe Introduction to EDR room completed 100 percent — Introduction to EDR

TryHackMe Introduction to SIEM room completed 100 percent — Introduction to SIEM

TryHackMe SOC L1 Alert Triage room completed 100 percent — SOC L1 Alert Triage

TryHackMe SOC L1 Alert Reporting room completed 100 percent — SOC L1 Alert Reporting

TryHackMe SOC Role in Blue Team room completed 100 percent — SOC Role in Blue Team

TryHackMe Junior Security Analyst Intro room completed 100 percent — Junior Security Analyst Intro

Certificate

In progress: THM SOC Level 1 path · CompTIA Security+ SY0-701 (exam planned December 2026)

What I can explain and demonstrate

Skills

Security operations

Alert triage and escalation
Phishing analysis
EDR and SIEM concepts
Incident response lifecycle (NIST phases)
Cyber Kill Chain, Pyramid of Pain

Linux (working knowledge)

Ubuntu on WSL terminal
chmod, chown, ps aux, ip a, ping
grep, awk, sort, uniq on /var/log/auth.log
file, sha256sum for file and hash checks

Networking

TCP/IP and DNS fundamentals
Wireshark packet capture
nmap host discovery, arp
Home network baseline

Working style

Follows procedures and documents decisions
Mentors new colleagues
Writes clear notes and reports in English (C1)

Where the discipline comes from

Experience

Nov 2016 – present
Aviation Security Agent, on-site equipment and technical support

EL AL Israel Airlines, Sofia (via Avrio Express)
- Second-line technical support for explosive trace detection (ETD) screening equipment: maintenance planning, basic troubleshooting and escalation.
- Part of the 2021 opening of a new international station in Marrakech (team of 7): set up and configured the ETD equipment, ran weekly maintenance, and proposed a multi-step check of local ground staff before aircraft arrival.
- Named Employee of the Year in 2021.
- Advanced passenger interviews and screening of higher-risk passengers and complex items.
- Maintain documented handling of sensitive and confidential information (need-to-know, chain of custody).
- Mentor for new colleagues for the last three years.
May 2011 – Oct 2016
Airport Security Officer

Vasil Levski Sofia Airport
- Access control: activated badge access across the airport complex and maintained and inspected access-control doors (2014–2016).
- Worked to ICAO, EASA and ECAC standards, audits and SOPs.
Education

Bachelor's degree, International Economic Relations

D. A. Tsenov Academy of Economics, Svishtov (2015)

Let's talk

Contact

I am looking for a Junior SOC Analyst or SOC L1 role in Sofia, hybrid or remote. I am happy to walk through any project or room on this page.