Detection engineering
Turning endpoint noise
into a signal.
A Wazuh + Sysmon lab for tracing Windows process activity and developing detections that can be tested and explained.
IDENTITY SECURITY / SOC / DFIR
I build your
digital identity.
I defend your digital world.
Ruslan Bedoev. HTB Certified Defensive Security Analyst.
Engineering secure access, building detections, and turning security telemetry into evidence.
HTB CDSA CertifiedGoogle Cybersecurity Professional Certificate
TELEMETRY / IN CONTEXTFIG. 01
01 COLLECT → 02 CORRELATE → 03 INVESTIGATEEvery signal has a story.
BUILT IN THE LAB. GROUNDED IN EVIDENCE.
01 / SELECTED WORK
Inside the work.
Practical security work. Clear outcomes.
An honest look at what’s built—and what’s next.
Turning endpoint noise
Cloud SIEM
Making cloud telemetry
investigation-ready.
A Microsoft Sentinel lab connecting Windows and Azure telemetry with KQL exploration and security workbooks.
Digital forensics & incident response
Reconstructing the story
behind an intrusion.
HTB CDSA investigation work across endpoint, network, and Active Directory evidence, from initial leads to incident reporting.
Network & vulnerability analysis
Finding exposure.
Understanding the risk.
Practical labs combining network monitoring, packet analysis, and vulnerability assessment with validation and remediation priorities.
Identity & access management
Identity built for
secure access.
An Okta-to-PingOne migration lab with a DaVinci authentication journey, connected to a Flask OIDC application and validated through login and token testing.
Personal labs and certification work. Each project separates demonstrated progress from planned work.
02 / BEHIND THE WORK
Ruslan Bedoev
Identity security, SOC & DFIR practitioner
Curiosity starts the investigation.
Evidence drives the response.
The practitioner behind ShieldMarkTech, focused on identity and access management, SOC and MDR workflows, digital forensics, SIEM, and threat detection. Hands-on work spans Okta and PingOne integrations, DaVinci authentication journeys, Windows telemetry, network analysis, and clear incident reporting.
HTB CDSA certified, with the Google Cybersecurity Professional Certificate. Currently expanding Microsoft Sentinel and Wazuh labs while preparing for Microsoft SC-200.
In progressMicrosoft SC-200
THE ANALYST’S TOOLKIT
01
SIEM & detection
Microsoft Sentinel · Wazuh · Splunk · Elastic
KQL · Sysmon · Sigma · YARA
02
Investigation & response
Windows logs · Memory analysis · PCAP analysis
Incident timelines · IOCs · Reporting
03
Network & vulnerability
Suricata · Wireshark · Nmap
Qualys · OpenVAS / Greenbone
04
Identity & access management
Okta · PingOne · DaVinci · Keycloak · Auth0
OIDC · OAuth 2.0 · SAML · Flask
Continuously learning. Deliberately building.
LET’S CONNECT