SECURITY • CURIOSITY • CONTINUOUS GROWTH
Security Engineer Trainee
Driven by a deep curiosity for cybersecurity, I learn by doing — investigating, building, experimenting, and continuously pushing myself to understand how systems can be attacked and defended.
Scroll to explore↓
01About
I’m Roshinni Gandhi — a Security Engineer Trainee building my career around cybersecurity, hands-on learning, and continuous curiosity.
My journey into security started with a desire to understand how systems work, where they fail, and how those weaknesses can be identified and defended. Since then, I’ve been building practical experience across security monitoring, SIEM, endpoint security, network analysis, and incident investigation.
Today, I work in an MSS environment where I get exposure to real security operations — monitoring alerts, investigating events, supporting endpoint and security services, and documenting findings and operational processes.
Outside day-to-day operations, I continue exploring the offensive side of security through labs, experimentation, and security research. My goal is to grow into someone who understands both sides of the problem: how systems are attacked, and how they can be better defended.
More about me02Focus
Areas I work in, learn about and explore — labelled honestly rather than scored.
Monitoring, triaging and investigating security alerts across client environments, while following operational procedures and escalation workflows.
Working with security logs, alerts, queries and dashboards to identify relevant events and support investigation.
Working with endpoint telemetry, EDR, endpoint management and DLP to investigate activity and support endpoint security operations.
Building deeper understanding of network traffic, protocols, firewall activity and how network evidence supports investigation.
Following evidence across logs, endpoints and network activity to understand what happened, why it happened and what needs attention.
Exploring automation for alert handling, enrichment and repetitive security operations through workflow-based tooling.
03Work
Hands-on projects, labs, investigations and practical security work — written up as case studies rather than thumbnails.
A SOC-style Splunk dashboard built on a real public SSH authentication dataset, correlating failed-login patterns across thousands of events to identify brute-force sources and confirm whether any resulted in compromise.
Nine custom, MITRE ATT&CK-mapped Splunk detections built end-to-end in a self-built Linux/Windows lab — each attack manually executed, its telemetry captured firsthand, and the resulting alert validated against real logs.
An ongoing body of original threat research and technical security writing — from a hands-on APT28 intrusion lab replication to foundational explainers spanning networking, cryptography, and Zero Trust architecture.
04Writing
Technical writeups, investigations and lessons learned — the record of the thinking, not just the result.
A source-grounded reconstruction of the 2015 Bundestag intrusion attributed to APT28 — mapping the public record to MITRE ATT&CK, then replicating the delivery, lateral movement, C2, and collection mechanisms in an isolated lab to surface real detection gaps.
Why hashing is the silent protector of digital trust — how it secures passwords, powers digital signatures, underpins Windows credential storage, and why hash collisions matter.
How secret keys keep your data safe online — the difference between symmetric and asymmetric encryption, where each is used, and where encryption shows up in everyday life.
05Experience
Jun 2026 – Present
A0 Cyber Security Private Limited
Investigating and escalating EDR/SIEM alerts, analyzing phishing threats, and automating detection workflows to strengthen MSS delivery for live client environments.
Mar 2026 – May 2026
A0 Cyber Security Private Limited
Hands-on EDR alert investigation, endpoint compliance management, and MFA implementation across a live production environment.
Oct 2025 – Jan 2026
Cyber Secured India
Coordinated cybersecurity training and internship programs, managing scheduling, documentation, and communication.
Jul 2025 – Oct 2025
Cyber Secured India
Organized training content and validated the technical accuracy of cybersecurity learning resources.
Apr 2025 – Jun 2025
Cyber Secured India
Hands-on exposure to security monitoring and digital forensics fundamentals using Nmap, Wireshark, Burp Suite, and Kali Linux.
06Achievements
Moments that marked real progress — certifications, training and recognition, in the order they happened.
2026-03-06
Hack The Box Academy
Completed the SOC Analyst learning path, covering log analysis, alert triage, and incident investigation fundamentals. Awarded the Vigilant Sentinel badge (top 0.1% of learners).
2025-06-29
Cyber Secured India
Achieved 95.42% in the Cyber Security & Digital Forensics Internship Program, ranking among top performers across practical and theory assessments.
07Learning
What I'm working through right now — stated as status, never as a percentage.
Studying advanced persistent threat techniques, attack patterns, and MITRE ATT&CK mappings to understand how real-world attacks unfold.
Understanding how to design, implement, and validate detection rules for real-world threats.
Developing proactive threat-hunting skills to identify advanced threats that bypass traditional defenses.
How I work