Melbourne · Open to SOC & junior security roles
Security analyst in training.
I build investigation tools that make incident handovers clearer, backed by a software and automation background.
The alert says
j.tan signed in from Jakarta, nine minutes after Melbourne.
“Jakarta” = geo-IP of 198.51.100.18 · signin.log #214
Provenance
Where did “Jakarta” come from?
198.51.100.18 → geo-IP → “Jakarta”
The city is a lookup result. The log never recorded a location.
Process
How was each fact produced?
Source IP 198.51.100.18, user j.tan, 02:06 UTC
signin.log #214198.51.100.18 is the company’s approved VPN exit
network register · VPN-EXIT-03VPN routing likely explains the location change
#213 tunnel up 5 s before · not proof of identityKeep open for identity and session checks.
analyst decision · evidence still incompleteUtility
What matters, and what happens next?
Synthetic training data. IPs are from documentation ranges.
01 / Selected work
Open the tool. Follow the reasoning. Explore the code.
Featured / Security operations training
Work the alert.
Leave a useful handover.
A browser training lab I built for junior analysts. Six guided cases cover email security, identity, endpoint activity, data access, detection tuning and handover, alongside a role-based incident simulator with P1–P5 scoring and an audit trail.
React · TypeScript · Vite · Python · Streamlit · SQLite · pytest · GitHub Actions
No account required. Progress stays in this browser.
Security / Written analysis
Four worked synthetic investigations, each separating the evidence, the decision, and the reasoning the next analyst needs.
Read the casebook ↗Backend security / Open source
A multi-tenant stock API I built in C#. Tenant identity comes only from the signed JWT, every query is scoped to it, and cross-tenant requests return 404 so records can’t be probed.
ASP.NET Core · FastEndpoints · Dapper · SQLite · JWT · BCrypt
Explore the code & setup ↗Other projects
A provenance-first hardware reference. Products, components and standards, with every assertion tied to a source and known gaps left visible.
Python · SQL · Three.js
Explore Structura ↗A regional cultural archive for Bandung and Kanazawa, with sourced introductions, credited photography, and clearly marked research gaps.
JavaScript · Vite · Supabase · Node test runner
Explore LocalCanon ↗Source ↗02 / Free resources
A reusable analyst template for separating facts, assumptions, unknowns, and the next action. Use it alongside a synthetic Lighthouse case.
Download the template ↓Plain text · Free download · No signup
Inside the template
03 / About
I’m a Melbourne-based IT graduate (Bachelor of IT, Torrens University) moving into security operations. I’ve just begun a Master of Cyber Security and Artificial Intelligence at Griffith University.
I hold ISC2 Certified in Cybersecurity and the Google Cybersecurity Certificate, and I’m working toward CompTIA Security+.
My approach comes down to three things. Provenance: trace every claim back to its source. Process: keep what I extracted, verified, inferred and decided clearly separate. Utility: finish with what matters and what someone should do next.
Working with: Linux · Wireshark · Python · SQL · C# / .NET · TypeScript · React · Git · GitHub Actions
Explore my work on GitHub ↗
Field note / Connection · Verification · Handover
Lighthouse turns that principle into practice: establish what the evidence supports, record what remains unknown, and leave the next analyst a clear starting point.
See the approach in Lighthouse →04 / Keep in touch
Source code, project documentation, and technical experiments.
Explore repositories ↗Writing on technology and AI, published on Medium.
Read on Medium ↗Professional background and career updates.
View my profile ↗For security roles, project questions, and feedback.
Email Richard ↗