Trynton Johnson

Experience

1. Jul 2025 to present

   CSOC Analyst (contract)

   Energy and utilities company

   • Investigate CrowdStrike Falcon detections by reviewing process trees, command lines, file and registry activity; correlate endpoint evidence with Splunk ES and Sentinel to assess scope and escalate confirmed threats.
   • Conduct targeted threat hunts across Falcon and SIEM telemetry for suspicious processes, credential abuse and lateral movement, pivoting on hosts, accounts, IP addresses and indicators.
   • Coordinate endpoint malware remediation with response teams, validate removal of suspicious files and registry entries, review follow-up scans, and document actions in ServiceNow.
   • Investigate phishing and suspicious sign-ins using Proofpoint, Entra ID and Microsoft Defender, corroborating user context and authentication evidence before escalation or closure.
   • Review firewall and WAF activity alongside endpoint and identity logs to assess web requests, malicious IP indicators and downstream activity; summarise findings for shift handoff.
   • Analyse failed authentication and credential-scanning patterns across multiple accounts, correlating Falcon detections with identity logs to assess source activity and escalation needs.
2. Apr 2023 to Feb 2025

   SOC Analyst

   IT and security services firm

   • Investigated CrowdStrike Falcon alerts in a 24x7 SOC, examining process trees, execution context and indicators to separate suspicious activity from benign behaviour and escalate confirmed threats.
   • Hunted for related activity by pivoting from Falcon endpoint indicators into Splunk, NetFlow and Wireshark packet captures to identify affected hosts and document scope.
   • Documented investigation findings, affected assets and escalation rationale to support incident handoffs across the SOC.
   • Performed Nessus vulnerability assessments and applied risk mitigation and information-assurance controls to harden systems.
3. Jun 2021 to Mar 2023

   Junior SOC Analyst

   Cybersecurity technology company

   • Monitored and analysed security events daily for 500+ users across multiple client tenants.
   • Investigated endpoint alerts across client environments, reviewing process execution, file paths and host activity.
   • Drove a 20% reduction in repeat incidents over six months through root-cause analysis and detection-tuning recommendations.
   • Triaged and escalated alerts to detect threats earlier in the kill chain.

Security focus

• Monitoring and alert triageCrowdStrike Falcon, Microsoft Defender, Proofpoint
• Incident investigation and escalationServiceNow, NIST 800-61
• SIEM analysis and correlationSplunk ES (SPL), Microsoft Sentinel (KQL), QRadar
• Endpoint detection and responseCrowdStrike Falcon, Defender for Endpoint
• Identity and authenticationEntra ID, Microsoft Sentinel
• Network telemetryFirewall and WAF logs, NetFlow, Wireshark, IDS/IPS
• Threat hunting and detection tuningMITRE ATT&CK, Splunk ES, Falcon, Wazuh (home lab)
• Security automationSOAR, Python, Playwright, n8n
• Insider risk and data protectionMicrosoft Purview

Tools

Splunk Enterprise Security, Microsoft Sentinel and KQL, QRadar, CrowdStrike Falcon, Microsoft Defender for Endpoint, Entra ID, Proofpoint, Microsoft Purview, ServiceNow, Wireshark and NetFlow, Nessus and Tenable, Wazuh

Selected projects

• Approval-Gated Agent PlatformRunning on a private server. A self-hosted automation platform built like a security control: least-privilege services, human approval, a hash-chained audit log, and an AI assistant with no network access. Its workload is my own job search.
• Wazuh Detection LabBuilt. A home SOC lab: a Wazuh server on Ubuntu with agents on Windows, Ubuntu and Kali Linux, used to attack a monitored Windows host and watch the activity land in the SIEM.
• AegisWorking prototype. An AI-security learning platform: prompt injection, tool poisoning and MCP risk, with labs where you attack and then detect.