Available for opportunities

Gursimran Singh

Cybersecurity Analyst  ·  SOC & Blue Team  ·  Security+ Certified

I build defensive security tools and dig into threats before they become incidents — focused on SOC operations, phishing analysis, and threat detection.

View My Work Get In Touch
⌥ GitHub ⚑ TryHackMe ◈ LinkedIn ◉ Instagram
01 — About

Who I Am

I'm an entry-level Cybersecurity Analyst with a CompTIA Security+ certification and hands-on experience in SOC operations, phishing analysis, and incident response.

My work lives at the intersection of defensive security and practical tooling — I don't just study threats, I build tools to detect and analyze them. PhishGuard, my phishing email analyzer, came from wanting to actually automate Tier 1 SOC triage, not just read about it.

330+
TryHackMe Labs Completed
SY0-701
CompTIA Security+ Certified
SOC
Blue Team Focused
4+
Security Tools Built
02 — Skills

Technical Toolkit

⬡ Security Operations
Incident Response Alert Triage Threat Detection Threat Hunting Log Analysis SIEM SOC Operations Malware Analysis DFIR AI Security
⬡ Tools & Platforms
Splunk ELK Stack Wireshark tcpdump Sysmon VirusTotal AbuseIPDB CyberChef Nmap Autopsy MS Defender CAPE
⬡ Scripting & Frameworks
Python Bash SQL MITRE ATT&CK NIST CSF Cyber Kill Chain CTI PowerShell
⬡ Network & Infrastructure
TCP/IP IDS/IPS Network Security EDR SOAR Vulnerability Assessment DNS SPF/DKIM/DMARC
03 — Experience

What I've Done

Self-Directed SOC Skills Development
Nov 2025 – Present
Self-Directed · Remote
  • Built a home lab to simulate enterprise networks, forwarding Windows Event logs and Sysmon data to a centralized SIEM for log and phishing analysis.
  • Developed custom Splunk searches and dashboards to detect anomalous behavior, brute-force login attempts, and unauthorized privilege escalation.
  • Completed 330+ blue-team and SOC-focused labs on TryHackMe covering threat hunting, incident response, memory forensics, malware analysis, and log analysis.
Cybersecurity Intern
Sep 2025 – Oct 2025
InLignX Global Private Limited · Bengaluru
  • Developed Python-based security tools for host discovery, service enumeration, and network analysis.
  • Built a PDF encryption utility using pypdf featuring a password-protected CLI workflow to secure sensitive files.
  • Created an ARP scanner using Scapy to active-scan networks, map architecture, and collect IP/MAC data.
  • Designed a multithreaded TCP port scanner with banner grabbing capabilities and CSV reporting.
04 — Projects

Featured Work

★ Featured Project
PhishGuard
A Python CLI tool for SOC analysts that automates Tier 1 phishing email triage — extracting IOCs, validating email authentication, enriching with live threat intel, and generating SIEM-ready alert reports.
⌥ GitHub Repo
What it does
  • Parses .eml files — headers, Reply-To chain, X-Originating-IP, Message-ID
  • Validates SPF, DKIM, DMARC from headers + live DNS record lookups
  • Extracts IOCs — URLs, IPv4s, attachment metadata from email body
  • Checks IPs against AbuseIPDB and URLs against VirusTotal APIs
  • Weighted risk scoring engine — outputs LOW / MEDIUM / HIGH verdict
  • Outputs structured JSON, plain text, HTML, and CEF for SIEM ingestion
  • Runs fully in offline mode without API keys
phishguard — output
$ python main.py -f samples/phishing_test.eml -o json # Parsing email headers... # Validating SPF / DKIM / DMARC... # Running DNS lookups... # Checking threat intel APIs...
{ "tool": "PhishGuard", "version": "0.2.0", "risk_level": "HIGH", "risk_score": 120, "flags": [ "SPF check failed", "DKIM signature missing", "DMARC check failed", "Reply-To mismatch: billing@paypal.com → collect@evil.ru", "Suspicious URL: paypal-verify.login.evil.ru", "High-abuse IP: 185.220.101.47 (score: 98)" ], "iocs": { "urls": ["http://paypal-verify.login.evil.ru/account"], "ips": ["185.220.101.47"] } }
Risk Score 120 — HIGH
Python 3 dnspython requests AbuseIPDB API VirusTotal API SPF/DKIM/DMARC JSON/CEF output CLI
⬡ Diagnostics Tool
Shuri
A fast, open-source workstation diagnostics CLI for IT support and security teams — a portable first-response toolkit that answers one practical question: what is the health of this workstation right now?
⌥ GitHub Repo
What it does
  • Checks CPU utilisation, core count, frequency, and system load
  • Reads memory and swap pressure, disk capacity, and free space
  • Inspects network adapters, MAC addresses, gateway, DNS, and reachability
  • Reads battery charge and capacity health on supported Windows laptops
  • Surfaces key Windows services, pending reboot/update state, and AV posture
  • Exports terminal, JSON, HTML, and Markdown reports
  • Shows every deduction that built the health score, not just the final number
shuri — output
$ shuri doctor -f json -o report.json # Checking CPU, memory, disk... # Checking network adapters & reachability... # Checking battery health... # Checking Windows services & update state...
{ "tool": "Shuri", "version": "0.1.0", "score": 92, "assessment": "Excellent", "deductions": [ "Pending reboot (-5)", "Low system-drive space (-3)" ], "calculation": "100 - 8 = 92" }
Health Score 92 — Excellent
Python 3.12+ Typer Rich psutil Jinja2 CLI Cross-platform
05 — Certifications

Credentials & Education

🛡
CompTIA Security+
CompTIA · SY0-701
🔐
Google Cybersecurity Professional
Google · Coursera
⚑
SOC Level 1
TryHackMe · Learning Path · Jul 2026
🧠
AI Security
TryHackMe · Learning Path · May 2026
🔎
Cyber Security 101
TryHackMe · Learning Path · Jun 2025
🌱
Pre Security
TryHackMe · Learning Path · Feb 2025
🎓
Cyber Security Expert Program
Training Certification
📘
BCA — Bachelor's in Computer Applications
GNIMT, Gujarkhan Campus · Ludhiana
06 — Contact

Let's Talk

I'm actively looking for Cybersecurity Analyst and SOC roles. If you're hiring or want to collaborate on security tooling, I'd love to connect.

PHONE +91 98149 33353 EMAIL gursimrann.singh12@gmail.com LINKEDIN linkedin.com/in/gurs1mrans1ngh GITHUB github.com/gsimransingh TRYHACKME tryhackme.com/p/gursimransingh INSTAGRAM @gursimrannsingh_12