[ LOADING PORTFOLIO ]

> SOC AND INCIDENT RESPONSE

> THREAT INTELLIGENCE

> SIEM AND DETECTION ENGINEERING

> GRC AND COMPLIANCE

> IDENTITY AND ACCESS MANAGEMENT

> VULNERABILITY MANAGEMENT

[ READY ]█

SHOURYA SAI MACHA ✦ SECURITY+ CERTIFIED ✦ NETWORK+ CERTIFIED ✦ SOC ANALYST ✦ THREAT INTELLIGENCE ✦ GRC / COMPLIANCE ✦ NIST 800 61 ✦ MITRE ATT&CK ✦ UNIVERSITY OF HOUSTON ✦ DEC 2026 ✦ SHOURYA SAI MACHA ✦ SECURITY+ CERTIFIED ✦ NETWORK+ CERTIFIED ✦ SOC ANALYST ✦ THREAT INTELLIGENCE ✦ GRC / COMPLIANCE ✦ NIST 800 61 ✦ MITRE ATT&CK ✦ UNIVERSITY OF HOUSTON ✦ DEC 2026 ✦ SHOURYA SAI MACHA ✦ SECURITY+ CERTIFIED ✦ NETWORK+ CERTIFIED ✦ SOC ANALYST ✦ THREAT INTELLIGENCE ✦ GRC / COMPLIANCE ✦ NIST 800 61 ✦ MITRE ATT&CK ✦ UNIVERSITY OF HOUSTON ✦ DEC 2026 ✦ SHOURYA SAI MACHA ✦ SECURITY+ CERTIFIED ✦ NETWORK+ CERTIFIED ✦ SOC ANALYST ✦ THREAT INTELLIGENCE ✦ GRC / COMPLIANCE ✦ NIST 800 61 ✦ MITRE ATT&CK ✦ UNIVERSITY OF HOUSTON ✦ DEC 2026
CTI LIFECYCLE ✦ SPLUNK SPL ✦ SIGMA RULES ✦ VULNERABILITY MANAGEMENT ✦ IDENTITY PROVISIONING ✦ AWS IAM ✦ PYTHON / FASTAPI ✦ DOCKER ✦ OpenVAS ✦ KILL CHAIN MAPPING ✦ CTI LIFECYCLE ✦ SPLUNK SPL ✦ SIGMA RULES ✦ VULNERABILITY MANAGEMENT ✦ IDENTITY PROVISIONING ✦ AWS IAM ✦ PYTHON / FASTAPI ✦ DOCKER ✦ OpenVAS ✦ KILL CHAIN MAPPING ✦ CTI LIFECYCLE ✦ SPLUNK SPL ✦ SIGMA RULES ✦ VULNERABILITY MANAGEMENT ✦ IDENTITY PROVISIONING ✦ AWS IAM ✦ PYTHON / FASTAPI ✦ DOCKER ✦ OpenVAS ✦ KILL CHAIN MAPPING ✦ CTI LIFECYCLE ✦ SPLUNK SPL ✦ SIGMA RULES ✦ VULNERABILITY MANAGEMENT ✦ IDENTITY PROVISIONING ✦ AWS IAM ✦ PYTHON / FASTAPI ✦ DOCKER ✦ OpenVAS ✦ KILL CHAIN MAPPING

SECURITY PORTFOLIO

SHOURYA SAI MACHA

[ SECURITY ANALYST · CTI · GRC ]

I'm Shourya, a CIS student at the University of Houston. I work where incident response meets automation: triaging alerts, pulling IOCs, and writing Python and SQL that handles the tedious analysis so a human doesn't have to. I'd rather chase a root cause than patch over it.

LOC //Sugar Land, TX → Houston, TX
EDU //University of Houston, B.S. CIS
STATUS //AWS Cloud Practitioner, in progress
[ VIEW PROJECTS ][ DOWNLOAD RESUME ↓ ][ CONTACT ][ GITHUB ↗ ]
SECTION.02 // CAPABILITIES

SKILLS MATRIX

WHAT I WORK WITH

PROFICIENCY_CHART // HOVER NODES TO INSPECT MODULE

SKILL MATRIXPROFICIENCY
02468SOC/IRCTIGRCVuln MgmtSIEMNet/EPIAMCloudDev

These levels are self assessed, not from an external benchmark.

MODULE_01 // SOC & INCIDENT RESPONSE

Security MonitoringAlert TriageIOC ExtractionNIST 800 61Incident ClassificationEvidence HandlingContainment & RemediationEscalation WorkflowsDigital ForensicsRoot Cause Analysis

MODULE_02 // CYBER THREAT INTELLIGENCE

TTP ProfilingAdversary Campaign AnalysisCTI LifecycleKill Chain MappingMITRE ATT&CKMITRE ATT&CK for ICSIndicator EnrichmentStatic Artifact AnalysisBehavioral DetectionMalware Triage

MODULE_03 // GRC & COMPLIANCE

RMFNIST SP 800 37NIST SP 800 53SSP DevelopmentATO ProcessPOA&M TrackingISCMHIPAAFISMAFedRAMPCMMCSOC 2PCI DSSGDPRSOXGLBAISO 27001NIST CSFOWASP Top 10

MODULE_04 // VULNERABILITY MANAGEMENT

OpenVASNessus / TenableCVSS ScoringNIST SP 800 115Patch ValidationOT/ICS Attack SurfacePenetration TestingThreat ModelingBaseline Hardening

MODULE_05 // SIEM & DETECTION ENGINEERING

Splunk (SPL)Elastic / KQLMicrosoft SentinelELK StackWazuhSigma Rule AuthoringCorrelation Rule LifecycleAlert TuningMITRE Navigator

MODULE_06 // NETWORK & ENDPOINT SECURITY

Firewall Log ReviewNetwork SegmentationNmapWiresharkpfSenseIDS/IPSEndpoint HardeningBurp SuiteMetasploit

MODULE_07 // IAM & ACCESS CONTROL

Identity ProvisioningLifecycle ManagementRBACLeast PrivilegeUser Access ReviewsAuthentication WorkflowsCIA Triad

MODULE_08 // CLOUD & INFRASTRUCTURE

AWS IAMAWS EC2AWS RDSCloudTrailAzure SentinelAzure DefenderDockerKubernetesTerraformLinux AdminDevSecOps

MODULE_09 // DEVELOPMENT & AUTOMATION

PythonFastAPIFlaskBashPowerShellSQL (MySQL, PostgreSQL, SQLite)JavaScriptNode.jsREST APIsGit
SECTION.03 // PROJECTS

PROJECTS

SELECTED WORK // SECURITY AND AUTOMATION

PRJ 01

MITRE ATT&CK TTP MAPPER

I worked through 1,200+ incident records to automate IOC extraction, indicator enrichment, and correlation of adversary techniques to MITRE ATT&CK across the full CTI lifecycle. It produces kill chain maps and NIST CSF control gap reports, and exports Sigma rules for Splunk, Elastic, and Azure Sentinel. It cut my SOC review time by about 60% and improved detection accuracy by about 25%.

PythonFastAPIStreamlitPlotlyDocker
60% ANALYST TIME ↓25% DETECTION ACCURACY ↑
[ BUILT ][ VIEW REPO ↗ ]
TERMINAL // PRJ 01
# MITRE ATT&CK TTP Mapper
> python ttp_mapper.py --source incidents.json
Correlated 1,200+ incident records to ATT&CK
> python enrich.py --export sigma
Sigma rules exported for Splunk, Elastic, Sentinel
MITRE Navigator heat map generated
Review time down ~60%, detection up ~25%
> █
PRJ 02

IoT / OT ATTACK SURFACE SCANNER

I ran authenticated and unauthenticated scans with OpenVAS methodology, mapped to MITRE ATT&CK for ICS, to find exposed CVEs, open ports, and misconfigurations. Findings get CVSS scores in the style of a Nessus or Tenable report, and I track each one through patch validation. I followed NIST SP 800 115 for the testing method and surfaced the results in a Next.js dashboard that uses GPT 4o to turn technical risk into prioritized fixes.

PythonFastAPINext.jsOpenVASGPT 4o
CVE ENUMERATIONNIST SP 800 115
[ BUILT ]
TERMINAL // PRJ 02
# OT Attack Surface Scanner
> openvas --target 10.0.0.0/24 --auth
Authenticated scan complete
CVEs, open ports, and misconfigs enumerated
> python cvss_report.py --framework ics
CVSS scored findings, mapped to ATT&CK for ICS
Risk summarized for remediation (GPT 4o)
> █
PRJ 03

EMAIL PHISHING DETECTION TOOL

I automated triage for 500+ .eml files: deobfuscating malicious HTML, pulling hidden URLs, and running SPF, DKIM, and DMARC header forensics. It enriches indicators through the VirusTotal API in real time and maps techniques to MITRE ATT&CK T1566. It cut manual review time by about 40% and raised detection accuracy by about 30%.

PythonVirusTotal API
40% REVIEW TIME ↓30% DETECTION ↑
[ BUILT ][ VIEW REPO ↗ ]
TERMINAL // PRJ 03
# Phishing Detection (ATT&CK T1566)
> python phish_detector.py --dir ./emails/ --vt
Triaged 500+ .eml files
Deobfuscated HTML, extracted hidden URLs
SPF / DKIM / DMARC checked
Indicators enriched via VirusTotal
Review time down ~40%, detection up ~30%
> █
PRJ 04

SECURE AUDIT LOGGING SYSTEM

I built a tamper evident audit logging system that cryptographically chains events across 50+ endpoints and is designed to stay intact even if part of it fails. It aligns to the NIST SP 800 53 AU and SI control families, SOC 2, and FISMA, so it produces the kind of evidence an ATO needs. I also wrote and tuned the Sigma rules that feed Splunk, Elastic, and Azure Sentinel. It cut forensic analysis time by about 35%.

PythonFlaskSQLite
35% FORENSIC TIME ↓NIST SP 800 53 AU/SI
[ BUILT ][ VIEW REPO ↗ ]
TERMINAL // PRJ 04
# Secure Audit Logging (NIST SP 800 53 AU)
> python audit_chain.py --init
Cryptographic chaining across 50+ endpoints
Tamper evident capture active
> python sigma_export.py
Sigma rules for Splunk, Elastic, Sentinel
Forensic analysis time down ~35%
> █
PRJ 05

COMP, CARE OPTIMIZATION AND MEDICATION PROCESSING

Built during a public interest healthcare compliance challenge, where it earned an honorable mention. It applies AI governance ideas to simulate a pre submission insurance medical reviewer: it returns specific named compliance flags with rebuttals drawn from patient history, then drafts approval ready letters and post denial appeal scripts. The aim was to cut roughly 13 hours of documentation work per physician each week.

Base44AI
13 HRS/PHYSICIAN/WEEK TARGET
[ HONORABLE MENTION ]
TERMINAL // PRJ 05
# COMP, healthcare AI compliance
> comp_ai review --records records.json
Pre submission insurance review simulated
Named compliance flags with rebuttals
Approval letters and appeal scripts drafted
Targeting ~13 hrs/physician/week saved
> █
PRJ 06

SENIOR FACILITY ROOM OCCUPANCY SYSTEM

A full stack system for a senior living facility covering 200+ residents and 100+ rooms. I designed role based access control and the full IAM lifecycle, set up least privilege tiers, configured AWS IAM policies, and ran MySQL backed identity workflows on AWS RDS. The REST APIs respond in under 100ms, and I used parameterized queries and input validation to close OWASP A03 injection risks.

PythonFlaskNode.jsMySQLAWS RDS
<100ms QUERY LATENCY200+ RESIDENTS
[ BUILT ][ VIEW REPO ↗ ]
TERMINAL // PRJ 06
# Room Occupancy (IAM + AWS RDS)
> python setup_iam.py --roles admin staff resident
Role based access: 3 tiers provisioned
AWS IAM policies applied
> curl /rooms
REST APIs respond in under 100ms
Parameterized queries (OWASP A03)
> █
SECTION.04 // EMPLOYMENT

EMPLOYMENT RECORD

CURRENT ROLE // UNIVERSITY OF HOUSTON

EMPLOYER: MD ANDERSON LIBRARY // UNIVERSITY OF HOUSTON

STUDENT IT ASSISTANT

DATES: FEB 2024 to PRESENT

LOG_01 // INCIDENT RESPONSE

I handle detection and analysis for 50+ security alerts a day across network, digital, and print systems at the library, following NIST 800 61. I classify severity, run the escalation workflow, then triage, contain, and document each incident. Over two years I have kept the escalation backlog at zero.

[ 50+ DAILY ALERTS ][ ZERO ESCALATION BACKLOG ][ 2+ YEARS ]

LOG_02 // DOCUMENTATION & TRAINING

I wrote 10+ security documents the team still uses: incident response playbooks, access control procedures, and remediation runbooks aligned to NIST SP 800 53. They were adopted across the organization, and I built the training materials new IT staff onboard from.

[ 10+ SECURITY DOCS ][ NIST SP 800 53 ][ ORG WIDE ADOPTION ]

LOG_03 // IDENTITY & ACCESS MANAGEMENT

I run identity provisioning and access reviews for 100+ accounts on research platforms like JSTOR, ProQuest, and EBSCOhost. I enforce role based access and least privilege, and I have kept 10,000+ physical and digital records intact with no data handling incidents.

[ 100+ ACCOUNTS ][ 10,000+ RECORDS ][ ZERO DATA INCIDENTS ]

LOG_04 // VULNERABILITY & REMEDIATION

I find weak spots across the network and critical systems, then fix them with firewall config changes, network segmentation corrections, and endpoint hardening. I track each finding through to resolution and keep audit ready POA&M style records.

[ FIREWALL CONFIG ][ NETWORK SEGMENTATION ][ POA&M RECORDS ]
SECTION.05 // CERTIFICATIONS

CERTIFICATIONS

CERTIFICATIONS AND EDUCATION // VERIFIED

EDUCATION

University of Houston, B.S. Computer Information Systems

EXPECTED DEC 2026 // GPA 3.425

RELEVANT COURSEWORK

Network SecuritySystems Analysis and DesignDatabase ManagementNIST CSF and SP 800 53PCI DSSSOXGLBAOrganizational Leadership

CERT 001

CompTIA

Security+

SY0 701

[ ACTIVE // 2025 ]

CERT 002

CompTIA

Network+

N10 009

[ ACTIVE // 2025 ]

CERT 003

Amazon Web Services

AWS Cloud Practitioner

CLF C02

[ IN PROGRESS // 2026 ]

PROGRESS:

SECTION.06 // CONTACT

GET IN TOUCH

SEND ME A MESSAGE

SEND A MESSAGE // EMAIL
EMAIL //mr.moststreams@proton.me
GITHUB //github.com/mauLanarhodes
LINKEDIN //linkedin.com/in/machaman
LOCATION //Sugar Land, TX → Houston, TX

SHOURYA SAI MACHA // B.S. CIS // UNIVERSITY OF HOUSTON // DEC 2026