📄 English Printable CV (A4) — Press Ctrl + P → Save as PDF

ALEKSEI ZHARKOU

Security Engineer • SOC Analyst (Blue Team / DFIR) • DevSecOps & Detection Engineering

Minsk, Belarus (Remote / Hybrid / Relocation) • +375 (29) 554-80-55
Email: lyosha.zharkov.98@mail.ru • Telegram: @Voobrazhenie_20
Portfolio: voobrazhenie21-lab.github.io • GitHub: github.com/Voobrazhenie21-lab • LinkedIn

Executive Summary

Hands-on Security Engineer & Incident Responder (DFIR) specializing in building low-false-positive threat detection tools, Linux server & Active Directory security, and multi-stage intrusion forensics. Creator of open-source detection engines (PipeShield v1.1 and Log Sentinel v1.3) engineered with mathematical false-positive suppression (Shannon Entropy), multi-format log correlation, and native OASIS SARIF 2.1.0 integration. Experienced in analyzing practical web and domain exploitation (obfuscated web shells, RCE, Pass-the-Hash, Kerberoasting), Linux daemon privilege isolation (systemd, auditd, container namespaces/cgroups), and directing AI coding agents to rapidly ship tested, production-ready security software.

Technical Stack & Core Competencies

SIEM & Detection Engineering:	Wazuh SIEM (4.3.9), TheHive IRP, ELK Stack (Winlogbeat), Low-False-Positive Rule Authoring (Regex + Shannon Entropy $H(X)$), MITRE ATT&CK v15 Mapping, OASIS SARIF 2.1.0, Multi-Layer Signal Correlation.
DFIR & Malware Analysis:	Obfuscated Web Shell Deobfuscation, CVE Exploit PoC Analysis (`CVE-2019-1458`, `CVE-2019-0623`), Crash Forensics (Windows WER, Defender 1116/5007, Recent LNK, `$Recycle.Bin`), VirusTotal TI.
Web, AD & Offensive Security:	OWASP Top 10 (RCE, Command/SQL Injection, Unrestricted Upload, Path Traversal, SSRF, XSS), BloodHound CE, Impacket (`ntlmrelayx`), Rubeus (Kerberoasting), Mimikatz, Pass-the-Hash, Nmap, Hashcat.
Linux & Network Security:	Ubuntu / RHEL / CentOS / Kali Linux, `systemd` Service Hardening, Linux Privileges (UID 0 vs `www-data`), `auditd`, File Integrity Monitoring (FIM `whodata`), CIS Docker Benchmarks, L2/L3 (STP, 802.1Q VLAN, 802.1X), Wireshark.
Development & AI Workflow:	Python 3 (Standard Library, OOP, CLI), JavaScript / HTML / CSS, Bash, PowerShell, Automated Testing (`pytest`), GitHub Actions CI/CD, AI-Native Engineering (directing Antigravity IDE / Claude / Copilot agents with test verification).

Security Products, Detection Engines & DFIR Research (Open-Source)

1. PipeShield v1.1 — Low-False-Positive SAST, Container, CI/CD & JS Bundle Recon Scanner github.com/Voobrazhenie21-lab/pipeshield | Live Demo

End-to-End Product Ownership: Architecture, Detection Logic, False-Positive Reduction, JS Recon & SARIF 2.1.0 Integration

False-Positive Suppression at Scale: Designed a hybrid detection engine combining provider regexes with mathematical Shannon Entropy calculation ($H(X) > 3.8$ bits/char) to catch real cryptographic secrets while eliminating ~90% of false positives on benign strings, UUIDs, and long-tail code patterns.
JS/TS Bundle Recon & Client-Side Security (JsReconAnalyzer): Implemented rules (PS-JS-001..005) detecting hidden admin/debug API routes (/api/v1/admin, /internal/debug), dangerous DOM XSS sinks (innerHTML/eval), leaked RFC1918 origin IPs behind WAF, and exposed production .map SourceMaps.
Container, Supply Chain & CI Quality: Enforces CIS Docker Benchmarks and GitHub Actions security, exporting to OASIS SARIF 2.1.0 and an interactive HTML dashboard, backed by 33 automated Pytest unit tests across Python 3.10–3.13.

2. Log Sentinel v1.3 — Multi-Layer Host, Sysmon & Web Threat Detection CLI Engine github.com/Voobrazhenie21-lab/log-sentinel | Live Dashboard

Zero-Dependency Python Correlation Engine for Linux (auth.log / systemd), Web (Apache), and Windows/Sysmon Telemetry

Engineered a zero-dependency log normalization and correlation engine with 10 high-fidelity detection rules mapped to MITRE ATT&CK and Wazuh SIEM rule equivalents.
Detects web-shell uploads (/uploads/*.php), SSH/RDP brute-force, service sabotage (wazuh-agent stop / Rule 506), Kerberoasting (0x17), AS-REP Roasting (Event ID 4768 PreAuthType=0), Pass-the-Hash (4624 NTLM), Sysmon Event ID 10 LSASS memory dumping (0x1010), and deleted exploit crashes (WER 1001).

3. Enterprise DMZ Web Server & Active Directory Breach Investigation (DFIR Case: acme.skb) GitHub Repo | Live DFIR Report

Linux Web Daemon Root Cause Analysis, Malware/CVE Forensics & Wazuh SIEM Correlation

Linux Web Server Compromise & Daemon RCA: Investigated initial intrusion on an Ubuntu 20.04 web server via an obfuscated PHP web shell (backdoor.php, MD5: c97ba87745a4a9523e26c30a6529506a). Determined why the web shell immediately achieved UID 0 (root) access to /etc/shadow and /root/.ssh/authorized_keys: Apache 2.4.57 had been compiled from source in /usr/local/apache with the -DBIG_SECURITY_HOLE flag and run as root.
CVE Exploit PoC & Crash Forensics: Traced reverse SSH tunneling (sshd -R) and proved execution of a deleted kernel LPE exploit (CVE-2019-0623.exe) via Windows Error Reporting (WER AppCrash) artifacts, alongside cve-2019-1458.exe and mimikatz.exe executed over a redirected RDP drive (\\tsclient).
Multi-Host SIEM Engineering (21-Host Lab): Deployed Wazuh SIEM 4.3.9 agents, auditd rules, FIM (whodata), Fail2ban, and TheHive IRP across a 21-host segmented network in VK Cloud (soc-practice-reports).

4. Enterprise Penetration Testing & Vulnerability Assessment Report (PTES / NIST) GitHub Repo | Live Report

Conducted practical exploitation across web and domain infrastructure (BloodHound CE ACL graph analysis, Kerberoasting, SMB NTLM Relay, Pass-the-Hash) with full PoCs, CVSS v3.1 scoring, and defense-in-depth hardening roadmaps.

Professional Experience

Cybersecurity Practitioner & Open-Source Developer

Independent Security Projects & Labs | 2025 – Present

Built and shipped open-source detection tools (PipeShield, Log Sentinel v1.2, MyProfile v2.0 with SHA-256 FIM) using AI-assisted workflows and automated CI testing.

Clinical Psychologist & University Lecturer

Minsk Regional Clinical Center / BarSU | 2021 – Present

5 years of analytical diagnostic work, research publication, and high-pressure crisis decision-making; strong foundation in human-factor security (social engineering) and clear technical writing.

Education & Training

Cybersecurity Specialist 2.0 (Professional Program)

Skillbox (2025 – 2026) • 100% Completed (Diploma Defended)

Linux System & Network Administration, Web & AD Penetration Testing, SIEM Monitoring & Incident Response (Wazuh, TheHive), Python for Security, Final DFIR Diploma (acme.skb).

Baranavichy State University

Master’s Degree (2021) & Bachelor’s Degree in Psychology (2020)

Languages: Russian (Native), Belarusian (Native), English (B1/B2 — Technical Reading & Written Communication).