vishaltharu.com

Vishal Tharu

SOC analyst, detection engineer and CTF developer. Security+, RHCSA, M.S. Cybersecurity. Looking for entry‑level SOC and security analyst roles.

Email me Résumé (PDF) LinkedIn GitHub

About

M.S. Cybersecurity (CSUDH), Security+, RHCSA. I work on detection: Sigma rules, Wazuh and Sysmon telemetry, and tuning alerts until the noise is gone. A year of enterprise access administration at TCS taught me how identity breaks in practice. I also built and ran ISSA Los Angeles’s 2026 cyber range: 200+ challenges on Azure, with live monitoring of player activity during the event. I use Claude Code, Codex and Hermes agents daily to build and automate, and I check their output the way I’d check an alert: against the raw evidence. Open to SOC Analyst roles.

Experience

  1. Aug 2026 - Present Los Angeles

    CTF DeveloperISSA Los Angeles

    • Built and ran the chapter’s 2026 cyber range on Azure: a CTFd platform with 200+ challenges across web, crypto, forensics, OSINT and AI prompt injection, backed by 60+ containerized services.
    • Locked the origin to Cloudflare traffic only, kept challenge ports closed until launch, and gave every player a browser-based Linux terminal through Apache Guacamole with per-user provisioning.
    • Wrote custom CTFd plugins, including an admin console that tracks player activity live, and flag-integrity tooling that confirmed every challenge was solvable before the Oct 14 event.
  2. Oct 2026 - Present

    Systems Security Engineer (volunteer)Q’s Ministry / BHITS

    • Setting up and securing Google Workspace and Microsoft 365 for Nonprofits: Entra ID, MFA, least-privilege roles, account lifecycle and access reviews.
    • Reviewing authentication, RBAC, API and logging security for the organization’s API, ERP and LMS systems.
    • Digitizing the organization’s legacy radio and audio archive with malware screening, checksum verification and backups.
  3. Sep 2024 - Present

    SOC home labSelf-directed

    • Built a Wazuh and Sysmon SIEM lab with two live endpoints running 600+ Sigma rules mapped to MITRE ATT&CK, and removed 24 of 25 threat-intel false positives.
    • Investigated simulated incidents across endpoint, email, network, identity and cloud logs in Splunk, Elastic and Wazuh, documenting scope, IOCs and containment.
    • Tested detections against Sysmon, Zeek and Suricata data, and built anomaly detection on AWS CloudTrail and VPC Flow Logs.
  4. Aug 2025 - May 2026 California

    President, Cybersecurity ClubCSU Dominguez Hills

    • Led a 120-member club with a six-person officer team and four flagship events in the year.
    • Sole platform engineer for the ToroHack 10.0 CTF: 160+ challenges on 100+ Docker containers for 30 teams, built in 17 days on CTFd, MariaDB, Redis and nginx.
    • Also at CSUDH, 2024 to 2026: supplemental instruction leader and mentor, teaching assistant, and student assistant to the Vice Provost.
  5. Jun 2023 - May 2024 Ahmedabad, India

    Cybersecurity & Cloud Infrastructure InternGrras Solutions

    • Red Hat Linux administration, Ansible automation and AWS, passing the RHCSA during the program; then Python, then the CEH curriculum with hands-on labs.
  6. Sep 2021 - Aug 2022 Ahmedabad, India

    Assistant System EngineerTata Consultancy Services

    • Administered SAP access for 500+ enterprise users through ServiceNow: provisioning, deprovisioning and role changes under client SLAs.
    • Investigated authorization failures against role-based access requirements and joined client incident calls to fix them.

Projects

SOC 2.0 home lab

A self-hosted SIEM on real telemetry from two VMs: a Sigma engine running 600+ rules, stateful correlation for brute force and password spraying, Atomic Red Team on the Windows victim, and threat-intel enrichment with consensus scoring.

Live dashboardRepository

Web app pentest

Three-round pentest of my own web apps: XSS, SSRF, CORS and CSRF findings, retests, and a full scope and RoE package.

Repository

AWS secure banking

Five-phase secure AWS banking build with a threat model: IAM, encryption, WAF, VPC and NACLs, CloudTrail, GuardDuty.

Repository

Axios supply-chain response

IOCs, remediation steps and detection scripts for Windows, macOS and Linux after the March 2026 axios npm compromise.

Repository

SYN flood lab

SYN flood attack and defense lab: hping3 vs sysctl tuning, iptables rate limits and SYNPROXY.

Repository

Host a CTF at your event

Capture-the-flag competitions run in person, for an office, a healthcare team, a school or a community event: the challenges, the platform, and running it on the day.

Ask about a CTF

  1. Oct 2026ISSA Los Angeles

    ISSA LA Cyber Range

    200+ challenges on Azure across web, crypto, forensics, OSINT and AI prompt injection. Every player got a browser-based Linux terminal, and the admin console tracked player activity live.

  2. Apr 2026CSU Dominguez Hills

    ToroHack 10.0: Operation Black Meridian

    A five-phase, story-driven team CTF: 160+ challenges on 100+ containers for 30 teams, built in 17 days, with per-team flag injection and honeypot detection.

    Write-up

  3. Oct 2025GMiS CAHSI conference

    CTFd workshop

    A hands-on workshop on building and running a CTF, with the material published as a site.

    Workshop site

Certifications

  • CompTIA Security+ ce
  • Red Hat Certified System Administrator (RHCSA)
  • Google Cybersecurity Professional Certificate

Verify on Credly

Education

  • M.S. Cybersecurity California State University, Dominguez Hills Aug 2024 - May 2026
  • B.E. Information and Communication Technology L.J. Institute of Engineering and Technology, Gujarat Technological University Aug 2017 - May 2021

Contact

vishal@vishaltharu.com

linkedin.com/in/vishal-tharu github.com/Arryn21 Résumé (PDF)