Security operations
SIEM analysis, alert triage, and keeping investigations grounded in the activity and context that matter.
CYBERSECURITY / DEFENSIVE OPERATIONS
See the signal.
Strengthen the response.
Lee Bing Han — Cybersecurity Analyst & Threat Hunter
I work at the intersection of security operations and threat detection: investigating activity, understanding how attacks unfold, and turning evidence into clearer defensive action.
01 / PROFILEPRACTICAL DEFENSE, BUILT ON CONTEXT
Good security starts with understanding what’s actually happening.
With an IT foundation and a focus on cyber defense, I’m building capability across security operations, incident response, and threat hunting.
I’m interested in the work behind a useful detection: knowing the environment, asking a better question of the telemetry, and giving the next analyst something they can act on.
Where I focus02 / CAPABILITIESAREAS OF PRACTICE
From alert to understanding.
Connected disciplines that help make security work more useful, from the first signal to a stronger response.
Threat hunting & intelligence
Following investigative leads through telemetry, network evidence, and adversary behavior.
Detection & response
Developing practical detection ideas and contributing to incident investigation and response.
Cloud & automation
Building knowledge in cloud security and security automation as part of a broader defensive practice.
03 / SELECTED WORKLAB NOTES & INVESTIGATIONS
Learning by investigating.
Hands-on security work, documented as it develops.
SOC home lab
A hands-on SIEM environment for exploring log monitoring and alert analysis, from incoming events to an investigated signal.
SIEM · LOG ANALYSIS · ALERT TRIAGE
Malware investigation
A study of static and dynamic investigation techniques, using sandbox analysis to build a clearer picture of sample behavior.
STATIC ANALYSIS · DYNAMIC ANALYSIS
Project descriptions are editable starting points; link a write-up or repository when one is ready to share.
04 / BACKGROUNDBUILDING A DEFENSIVE PRACTICE
Grounded in IT.
Focused on defense.
An IT background shaped by a clear interest in cybersecurity: how systems are used, how threats leave evidence, and how defenders can respond with care and precision.
FOUNDATION
Information technology
A broad technical foundation informing how I approach security and system behavior.
DIRECTION
Cyber defense & operations
Focused development in security operations, threat hunting, incident response, and detection.
Specific roles and dates can be added here as they’re ready to share.
OPEN TO A GOOD CONVERSATION
Let’s build better defenses.
Interested in security operations, threat detection, or practical ways to strengthen a team’s defensive work?
Add a public email or professional profile here.