Cybersecurity Portfolio
Kehinde Justinah Coker
Aspiring SOC Analyst — Automation-Focused
Cybersecurity student with hands-on experience collaborating with team members in a project capacity on SOC monitoring, vulnerability management, SOAR automation, and phishing campaign analysis. Looking for a Cybersecurity Intern, SOC Analyst Intern, Junior SOC Analyst, Security Operations Intern, or Vulnerability Management Intern position to gain production experience from the foundation built by these projects.
About
I'm a cybersecurity student with hands-on experience collaborating with team members in a project capacity on SOC monitoring, vulnerability management, SOAR automation, and phishing campaign analysis. I'm interested in helping automate as much of the response side of security operations as possible, not just detection. I'm looking for a Cybersecurity Intern, SOC Analyst Intern, Junior SOC Analyst, Security Operations Intern, or Vulnerability Management Intern position to gain production experience from the foundation built by these projects.
Technical Skills
Monitoring & Detection
- Log review / alert triage (project-oriented)
- Wazuh (Endpoint Detection & Response / Open Vulnerability Assessment Language)
Vulnerability & Patch Management
- Patch management process implementation
- CVE enumeration / CVSS score assessment
- Tailscale (zero-config VPN)
Security Automation
- SOAR response playbook development
- DevSecOps pipeline integration security (SAST / DAST / scanner-agnostic dependency checking / secrets detection)
- Parsing findings into triage / routing logic
Social Engineering & Awareness
- Phishing campaign analysis and creation
- Email security (SPF / DKIM / DMARC records)
Reporting & GRC Exposure
- Security posture assessment and reporting, with NDPR awareness
- Intro-level familiarity with ISO/IEC 27001 GRC practices
Exposure through projects and coursework — not officially certified.
Featured Projects
ShieldOps — DevSecOps Pipeline & SOAR Automation Platform
Expadox Labs · Team ProjectProblem
Security scans typically run late — after deployment or during occasional pen tests — letting issues like hardcoded secrets and vulnerable dependencies reach production undetected.
Objective
Embed security scanning directly into CI/CD and automate the response to what it finds, instead of relying on manual review.
Architecture & Tools
SAST, DAST, dependency scanning, and secrets detection run on every commit; a SOAR layer enriches each finding with CVE/CVSS data, prioritizes it, and routes it to one of three automated playbooks (exposed secret, critical CVE, confirmed OWASP Top 10 flaw). Validated against a real, intentionally vulnerable test application.
My Contribution
I wrote the automated response playbook for the exposed-secrets finding type — the logic that determines how that specific kind of finding is triaged and routed once the pipeline catches it.
Results & Limitations
The team's dashboard tracks a mean-time-to-triage (MTTT) metric, reported by the team as faster than manual review.
Self-reported metric — not independently verified on this page; confirm with measured before/after data if available.
Lessons Learned
Writing response logic for a specific finding type (rather than just detecting it) requires thinking through false positives and escalation paths, not just the detection rule itself.
Endpoint Protection & Vulnerability Management Program
Team ProjectProblem
Starting point was zero visibility: no vulnerability scans had been run, patching was manual and untracked, and there was no endpoint detection capability.
Objective
Stand up endpoint visibility, vulnerability scanning, and a managed patch process from scratch.
Architecture & Tools
Tailscale for secure connectivity across managed endpoints, Wazuh for EDR and vulnerability scanning, Action1 for centralized patch management with a documented SLA policy.
My Contribution
I worked with my team on endpoint agent deployment, the patch management policy rollout, and documenting remediation progress transparently as it stood.
Results & Limitations
The initial scan surfaced a large critical-severity backlog on the Ubuntu host. A patch deployment policy was configured and a patch cycle run, but a post-patch re-scan had not yet been captured at reporting time, so critical/high counts in the report still reflect the original baseline.
Lessons Learned
Reporting remediation status honestly — including what's unconfirmed — matters as much as the remediation itself for a credible security program.
Security Monitoring, Analytics, and Response Executive Report
Team ProjectProblem
Prompted by a ransomware attack on a direct industry competitor that began through an unpatched machine with remote access exposed to the internet, demanding $2.3 million. Our team had the same blind spots: no asset inventory, no patch visibility, no monitoring.
Objective
Assess and document our own security posture, and the gaps that left us exposed to the same kind of attack.
My Contribution
I helped assess the security posture and document the findings and response in this report.
Results & Limitations
The report documents what the team found and the work undertaken in response, as a point-in-time executive summary rather than a completed remediation.
School-wide Phishing Attack Analysis & Student Guidance Report
Capstone Project · She Code AfricaProblem
Students are a high-risk, understudied demographic for phishing in the Nigerian context, despite heavy reliance on email and digital platforms.
Objective
Run a controlled phishing simulation to measure susceptibility, identify the technical and psychological indicators at play, and produce practical awareness guidance.
Architecture & Tools
A fake "EduSupport Foundation" scholarship email and landing page, built to exploit authority, scarcity, and social proof; sent to 25 participants via a controlled Slack channel. Simulated form data only — no real personal or financial information was collected or retained.
My Contribution
My task on the team was awareness creation — translating the simulation's findings into practical, plain-language phishing-awareness guidance for students.
Results & Limitations
Of 25 emails sent, 21 were opened (84%), 19 clicked the link (76% of those sent), and 15 submitted simulated sensitive data (60% of those sent). The team cross-checked the link with VirusTotal and found only 1 of several security vendors flagged it as phishing, underscoring that user awareness matters alongside technical detection. The study proposes a layered defense — awareness training, SPF/DKIM/DMARC email authentication, and a GRC approach aligned with NDPR and ISO/IEC 27001 — as recommendations, not implemented or certified controls.
Lessons Learned
Several participants who clicked the link stopped short of submitting data once asked for financial details — suggesting awareness can kick in mid-interaction, not just at first contact, which shaped how the awareness guide was written.
Education & Training
Ekiti State University, Ado-Ekiti, Nigeria
Bachelor of Science (B.Sc.) in Microbiology
Expected Graduation
September 2026
Relevant Academic Background
Microbiology, laboratory practices, microbial identification, and microbiological analysis.
Training & Development
She Code Africa — Cybersecurity Program (2026): completed a group capstone project, Phishing Attack Simulation & Analysis (Social Engineering / Email Security).
Expadox Lab — cybersecurity project team (ShieldOps DevSecOps Pipeline & SOAR Automation Platform).
Contact