Siebe Moeskops

Project Summary
The goal of this project was to build a Security Operations Center (SOC) capable of detecting cyberattacks and automatically responding to them. Rather than focusing solely on detection, the project aimed to create a complete security workflow that could identify malicious activity, analyze it, and take action without requiring manual intervention.

To demonstrate this, I built a Proof-of-Concept SOC environment and simulated real-world attacks against a Windows system. These attacks generated security events that were collected and analyzed by the monitoring platform. Custom detection rules were used to identify suspicious behavior, such as repeated failed login attempts that could indicate a brute-force attack.

When a malicious activity was detected, an automated response process was triggered. The system sent real-time notifications, gathered additional threat intelligence about the attacker, and automatically blocked the malicious IP address on the firewall. Existing connections from the attacker were also terminated to prevent further access.

To verify the effectiveness of the solution, the attack was repeated after the automated response had been executed. The connection was immediately blocked, confirming that the SOC was able to successfully detect, analyze, and contain the threat without manual intervention.

As part of my Graduate Degree in Systems and Network Management, I completed an internship at Remmicom, a Belgian IT service provider specializing in managed IT, networking, cloud solutions, and cybersecurity. During this internship, I gained hands-on experience in both technical support and system administration while working closely with the service desk team.

A large part of my role involved supporting customers in a professional business environment through phone calls, remote assistance, and ticket handling. This required not only solving technical issues, but also communicating clearly with end users, understanding their needs, and providing effective solutions within a customer-focused setting. In addition to remote support, I regularly visited client sites to assist with installations, troubleshooting, and IT projects, giving me direct exposure to real-world customer environments and professional IT operations.

Throughout the internship, I worked with technologies such as Active Directory, AXSGUARD firewalls, and email security solutions including SPF, DKIM, and DMARC. I also assisted with laptop deployments, user and permission management, infrastructure support, and the installation of specialized equipment at customer locations. This experience allowed me to develop both my technical skills and my ability to interact confidently with clients and colleagues in a professional IT environment.