Curriculum vitae

Ciaran Byrne

SOC Analyst, Level 3

SOC analyst with experience across enterprise incident investigation, threat hunting, DFIR support, malware-analysis workflows, and security-event triage. My work combines endpoint and SIEM telemetry, containment support, evidence-led reporting, reverse engineering, and detection refinement.

Experience

January 2026 - present

Edinburgh, UK

SOC Analyst (Level 3)

NatWest Group

Led the investigation of user-reported suspicious endpoint activity, identifying unrecognised archive downloads and Microsoft Defender telemetry that had not surfaced through the standard SOC alert queue.
Contained the potential compromise through endpoint isolation, account disablement and credential-reset actions; extracted hashes, IP addresses and domains for estate-wide scoping, briefed First Response, and produced the evidence handover supporting a device rebuild.
Worked with threat intelligence teams, peer financial institutions and national cyber-security partners to monitor geopolitical threats and hostile-state activity targeting the UK financial sector, translating intelligence into actionable hunting and monitoring priorities
Responded to a large-scale Layer 7 DDoS and SMS-pumping campaign, correlating application, network, geographic and telecommunications indicators to identify malicious infrastructure and abuse patterns.
Supported targeted IP blocking, geoblocking and telephone-number controls during the campaign, while investigating associated account activity and potential insider involvement.
Conducted proactive threat hunts following bug bounty disclosed web-application vulnerabilities, translating bug-bounty findings into searches for exploitation indicators, suspicious requests and post-compromise behaviour.
Trained and mentored L1/L2 analysts, improving investigative capability across endpoint analysis, telemetry correlation, containment, case progression, and response-team handover.

July 2023 - January 2026

Dundee, UK

Call Handler

NHS 24

Coordinated urgent responses across patients, nurses, specialist clinicians, GP out-of-hours services, and the Scottish Ambulance Service for complex and potentially life-threatening presentations.
Used adaptive communication and rapid problem-solving to assess patients with severe communication difficulties, establish their identity and location, and provide accurate information for emergency dispatch.
Managed highly distressed patients and families through traumatic and end-of-life situations, balancing emotional support, clinical requirements, patient dignity, and timely escalation.
Supported service continuity during a national clinical-system outage, conducting technical checks, escalating the failure, and agreeing an emergency referral process with senior nursing staff and ambulance dispatch
Produced clear and accurate case records and clinical handovers, enabling multiple healthcare teams to continue care without unnecessary delay or repeated assessment.

January 2022 - May 2022

Vermont, USA

Security Technician

The Leahy Center for Digital Investigation

Performed purple-team-style detection validation with SOC analysts, testing whether security rules reliably identified the adversary TTPs they were designed to detect.
Created exploit proofs of concept and controlled malware samples to detonate against SIEM and endpoint controls, measuring alert coverage and investigative visibility.
Identified false negatives and detection gaps, then collaborated with analysts to refine rule logic, telemetry sources, alert context, and triage effectiveness.
Built and deployed Elastic Stack SIEM environments for monitoring, adversary simulation, and investigation.
Built and deployed Elastic Stack SIEM environments to support security monitoring, adversary simulation, detection engineering, and investigation.

Selected work

King of the Forest: Competitive Cyber Security RangeHonours project combining offensive compromise, defensive monitoring, scoring, and user-activity simulation.
Network Forensics InvestigationPCAP preservation, Wireshark and Zeek analysis, reconstruction, decoding, and evidence-led reporting.
WannaCry Malware AnalysisStatic analysis, reverse engineering, isolated execution, memory forensics, and network-traffic review.
Authorised Payload Research LabPython automation for Windows payload packaging, build workflow design, and detection-behaviour research.
MIT Kerberos Integer Overflow ReviewC data-flow review covering integer conversion, allocation boundaries, parser security, and mitigation.

Education

September 2020 - July 2024

Dundee, UK

BSc (Hons) Ethical Hacking

Abertay University

Classification: 2:1. Study covered offensive security, penetration testing, red teaming, exploit development, malware analysis, secure coding, and system internals.

Dissertation: King of the Forest - Cybersecurity Training Environment.

August 2021 - May 2022

Burlington, Vermont, USA

Exchange Year in Cyber Security

Champlain College

Digital forensics, operating-system forensics, network forensics, threat hunting, defensive operations, and automation for system management and analysis.

GPA: 4.08/4.50.

2019 - 2020

Glasgow, UK

HNC Cyber Security and Networking

City of Glasgow College

Networking, operating systems, systems administration, and foundational cyber security before progression to university.

Professional development

Certifications

Offensive Security Certified Professional (OSCP): In progress
Hack The Box Certified Penetration Testing Specialist (CPTS): In progress

Additional experience

Securi-Tay speaker: technical talk on command-and-control frameworks and attacker tradecraft.
NECCDC: second place defending enterprise-style infrastructure against a professional red team.
TryHackMe contributor: created and supported the development of cyber security challenge rooms.

Technical profile

Security operations and incident response: Splunk, Microsoft Defender XDR, Microsoft Defender for Endpoint, Carbon Black, ServiceNow, FireEye, event triage, incident investigation, and containment support.
Digital forensics: Wireshark, Zeek/Bro, CyberChef, Elastic Stack, evidence handling, PCAP analysis, and endpoint and network artefact analysis.
Malware analysis and reverse engineering: Ghidra, IDA, x64dbg, REMnux, PEStudio, CAPA, behaviour analysis, obfuscation review, and suspicious-execution analysis.
Threat hunting and intelligence: KQL, Sigma, MITRE ATT&CK, IOC and TTP enrichment, alert investigation, infrastructure analysis, and detection refinement.
Cloud and infrastructure: AWS, CloudTrail, GuardDuty, Docker, Linux, Windows, and Active Directory.
Programming and tooling: Python, C++, C#, Java, Flask, SQLAlchemy, and SQLite.
Frameworks and security principles: OWASP, NIST, ISO 27001 principles, CWE, secure coding, and remediation reporting.