// Select a post to read
// Where I Study
Lancaster University
-
Top 10 in the UK
-
NCSC Gold ACE-CSE
-
ACE-CSR
Kenneth Cho — MSci Cyber Security, Year 1 · Lancaster University · based in Warrington, UK
Most of what I know about security didn't come from a textbook. I was part of the team that contained a real cyberattack during my studies, and I later worked full time in a high-throughput production environment. Now I'm studying MSci Cyber Security at Lancaster and running a home lab, turning that experience into hands-on engineering and detection skills. I still think the way I did then: assume breach, move fast, document everything.
I got into security because I find the adversarial nature of it genuinely fascinating. Every attacker has a technique; every technique has a tell. My job is to know the tells before the attack happens, and build systems that catch what human attention misses.
My experience so far combines hands-on incident response with structured operational and cloud-focused work, so I can hold a conversation about IAM policy misconfigurations just as easily as I can talk through how a live incident was handled. Good security people are also good communicators — the technical work only matters if stakeholders understand the risk.
Outside of lectures I run a home lab where I simulate attack scenarios, build detection tooling, and deliberately break things in controlled ways. It's where I stay sharp and stay honest about what I actually know versus what I think I know.
I approach every defensive task by asking: how would I get past this? That perspective keeps controls honest and detection logic grounded in reality, not wishful thinking.
Every incident I've worked, every system I've hardened, I leave a paper trail. Good documentation turns a one-off fix into institutional knowledge that survives personnel changes.
Active repositories, a home SOC running 24/7. As a student I learn by making things, not just reading about them, and that habit compounds fast.
During a part-time internship and live incidents, I've built SIEM detection logic that actually fires on real threats, not noise, mapping attack behaviour to MITRE ATT&CK and tuning pipelines in Splunk and Wazuh to cut false-positive fatigue.
AWS environments I touch get hardened with least-privilege IAM, GuardDuty coverage, and CloudTrail visibility from day one. Security by design, not as an afterthought.
Repetitive security tasks shouldn't stay manual. I write Python, Rust, and Bash automation to remove toil, from log parsing to endpoint compliance checks to custom alerting pipelines.
I've found and responsibly disclosed real vulnerabilities in test applications, using CVSS prioritisation and hands-on experience with Nessus and Burp Suite in structured assessment workflows.
I've been part of a live incident response under real pressure, not a simulation: helping contain spread, supporting coordination with authorities, and authoring documentation for the DR plan.
Orphaned accounts and privilege creep are silent risks. I've run joiner-mover-leaver reviews and access audits, turning IAM hygiene from a checklist into a repeatable process.
I don't list tools I've only watched tutorials on. Every item here is something I've used to solve a real problem, in a lab, an internship, or a live incident.
Highlighted items are where I'm strongest and most immediately effective on day one.
Currently in Year 1 of a four-year MSci in Cyber Security. Coursework is deepening my foundations in networking, operating systems, and security principles, complemented by my home lab where I simulate attack scenarios, write detection rules, and build tooling. Looking for a cyber security internship to apply what I'm learning in a real environment.
Running IoT-connected production machinery in a high-throughput environment isn't far from running infrastructure. You develop an eye for anomaly, when a system deviates from expected behaviour, you investigate before it becomes a failure. I built that instinct here: staying alert in noisy fast-moving environments, maintaining zero reportable safety incidents, and keeping 100% accurate logs that survived every audit cycle.
My first direct exposure to enterprise security workflows. I handled 20–30 support tickets weekly at 95%+ first-contact resolution, but the more interesting work was IAM hygiene, running user access reviews, catching stale accounts from leavers before they became a liability, and tightening endpoint antivirus compliance across the fleet. I left with runbooks that actually got used by the team after I left, which is the metric I care about.
This wasn't a tabletop exercise. A real attack hit school infrastructure during my T-Level studies, and a small team including myself stepped in to contain it. We isolated around 500 endpoints under pressure, executed a controlled shutdown to stop lateral spread, and I helped write the disaster recovery plan that brought systems back online securely. The post-incident documentation I contributed to became the foundation for the school's revised security posture. Coordinating that under real stakes, with external authorities involved, is the kind of experience that can't be manufactured in a lab.
My personal threat lab, ELK Stack and Wazuh running 24/7, ingesting logs from deliberately triggered attack scenarios. I simulate brute-force and lateral movement to test whether my detection logic actually catches them. Every rule I ship here is one I believe in.
Built from scratch: a secure VPC with least-privilege IAM, GuardDuty enabled from day one, CloudTrail covering every API call, and automated alerting that fires when something looks off. The goal was to make insecure actions the hard path, not the easy one.
Identified SQL injection and XSS vulnerabilities in test applications and disclosed them responsibly. The point wasn't just finding bugs, it was writing clear, actionable reports a developer could act on immediately. Proof that offensive skills and communication aren't mutually exclusive.
A private tool for structured malware analysis, static examination, behavioural logging, and IOC extraction into a usable format. Built to make analysis repeatable rather than ad-hoc every time a new sample arrives. Consistency is what makes analysis defensible.
A hands-on TypeScript environment for exploring JWT vulnerabilities: algorithm confusion, none-alg bypass, key injection. Understanding these attack paths deeply makes me more effective when reviewing authentication implementations in real systems.
A publicly available security utility built in JavaScript. Open source by design, I think the security community improves when people share tools rather than sit on them. Pull it, use it, improve it.
// Select a post to read
Got a cyber security internship, a project, or just want to chat about home labs and detection engineering? I'd love to hear from you.