Nguyen Cao Lam | Cybersecurity Portfolio

About

Hands-on Blue Team and security engineering practice.

Final-year Information Technology student specializing in Cybersecurity at Ho Chi Minh City University of Foreign Languages - Information Technology, seeking a SOC Analyst position.

Hands-on experience in security monitoring, alert triage, threat detection, log analysis, and incident response through SOC and SDN security labs. Tools include Wazuh, Suricata, Shuffle SOAR, Wireshark, FTK Imager, Eric Zimmerman Tools, Ryu, Mininet, AWS EC2, and MongoDB Atlas.

2027

Expected graduation

3.2

GPA / 4.0

SOC

SOC Analyst target

Resume

A concise overview of my cybersecurity work.

Download my résumé for my SOC, Blue Team, DFIR, cloud-security, and web-security experience.

Download Resume (PDF)

Focus Areas

Operational skills from labs and coursework.

01

Security Monitoring

Security monitoring, alert triage, log analysis, threat detection, incident response, and MITRE ATT&CK mapping.

02

Monitoring Tooling

Wazuh, Suricata, Shuffle SOAR, Wireshark, pfSense, alert correlation, and network traffic analysis.

03

Network Security & SDN

Ryu Controller, Mininet, Mininet-WiFi, SDN security architecture, firewall rules, and Wi-Fi mesh labs.

04

DFIR & Systems Analysis

FTK Imager, Eric Zimmerman Tools, Windows Event Logs, Registry, NTFS artifacts, memory, PCAP analysis, Linux, and Active Directory.

Projects

Selected technical projects.

Project 01 · 2025 - Present

SDN-based SOC with Automated Threat Detection and Response

Designed and implemented an SDN-based SOC integrating network monitoring, IDS, SIEM, SOAR, and automated network containment.

Integrated Ryu Controller, Mininet/Mininet-WiFi, Suricata IDS, and Wazuh SIEM for centralized security monitoring.
Correlated telemetry and SIEM alerts for triage, suspicious activity investigation, and MITRE ATT&CK mapping.
Connected Shuffle SOAR with the SDN controller to automate response workflows and malicious traffic containment.

Watch Demo

Project 02 · 2026

Cloud-based IoT Monitoring & Command Center

Designed and deployed a cloud-based IoT monitoring platform connecting ESP32 edge nodes to a centralized backend and dashboard.

Built telemetry collection and centralized event storage using ESP32, FastAPI, AWS EC2, MongoDB Atlas, and React.
Configured AWS Security Groups with restricted inbound access and database authentication.
Implemented HTTP polling for bidirectional device communication across NAT/firewall-restricted networks.

Watch Demo

Project 03 · 2024 - Present

DFIR Case Studies & Incident Response Labs

Completed hands-on investigations across simulated enterprise and endpoint compromise scenarios.

Examined disk, memory, pagefile, Autoruns, and PCAP artifacts in The Stolen Szechuan Sauce case study.
Completed CyberDefenders' SpottedInTheWild lab, investigating a suspected WinRAR-related endpoint compromise with Windows logs, Registry, NTFS, and SQLite artifacts.
Completed CyberDefenders' Silent Breach lab, analyzing a forensic image and Windows Mail (HxStore) artifacts to recover and decode case evidence.

Hands-on lab details available on request.

Project 04 · 2025 - Present

Reverse Engineering & Malware Analysis Practice

Hands-on security research practice focused on Windows executable analysis, debugging, and malware behavior investigation in controlled lab environments.

Analyzed Windows PE files, including headers, sections, imports, strings, and cross-references using static-analysis tools.

Used debuggers to trace execution flow, inspect registers and memory, and understand conditional branches and program behavior.

Practiced identifying malware-related artifacts and documenting findings from controlled reverse-engineering exercises.

Watch Demo

Academic Research

Research and scientific publication.

Accepted Paper · SoICT 2026

A Policy-Controlled Multi-Domain SOC: Architecture and Evidence-Based Security-Boundary Validation

Authors: Lam Cao Nguyen, Duc Manh Bui, and Thanh Tien Cao.
Faculty of Information Technology, Ho Chi Minh City University of Foreign Languages - Information Technology (HUFLIT).

Presents a policy-controlled multi-domain Security Operations Center (SOC) architecture that separates policy decisions from response execution and requires executor-specific evidence before an action can be marked VERIFIED.

Implemented response adapters for gateway containment, endpoint audit, and Ryu/OpenFlow, using evidence appropriate to each executor.
Isolated asynchronous LLM enrichment from deterministic detection and response, with an explicit payload allowlist, sensitive-marker checks, and rate limiting.
Validated SDN enforcement in 30/30 controlled runs, with the expected DROP flow state across five switches while preserving control traffic.
Measured a 74.02% median reduction in serialized LLM payload size across 55 alerts; 541 sensitive-marker checks found no observed leakage.
Used a persistent sliding-window rate limiter capped at 12 attempts per 60 seconds.

Evaluation was conducted in a fixed laboratory. The results do not establish production-scale reliability, detection accuracy, scalability, or LLM analytical quality.

Education & Language

Current academic background.

HUFLIT
Bachelor of Information Technology, Major in Cybersecurity. Expected Feb 2027. GPA: 3.2 / 4.0.
English
Technical documentation and professional communication.
Goal
Open to SOC Analyst roles with a Blue Team, monitoring, and incident response focus.

Contact

Open to SOC Analyst conversations.

Based in Ho Chi Minh City, Vietnam. Interested in Blue Team operations, security incident management, and continuous improvement of detection and response.

1904caolam@gmail.com 0937 025 017 github.com/1904caolam-tech LinkedIn profile