SOC & Detection Engineering
Splunk, Sysmon, Snort, Windows Security Events, detections, dashboards, alerts, investigations, and security monitoring.
SYSTEMS ADMINISTRATION • NETWORKING • CYBERSECURITY
Agyemang Prempeh
Building secure enterprise infrastructure, hybrid cloud environments, and security monitoring solutions.
I design and build practical infrastructure and security projects involving Windows Server, Active Directory, Microsoft Entra ID, AWS, pfSense, Splunk, Sysmon, Snort, VPNs, endpoint security, automation, networking, and security operations.
About
I am developing practical experience across systems administration, networking, cybersecurity, cloud infrastructure, identity management, security operations, and enterprise troubleshooting.
My work focuses on building complete environments rather than studying technologies in isolation. I design systems, configure infrastructure, implement security controls, collect telemetry, create detections, test access, troubleshoot failures, and document the final result.
My current portfolio includes Active Directory and SOC engineering, AWS hybrid cloud infrastructure, Microsoft Entra hybrid identity, secure IKEv2 remote access VPNs, centralized monitoring with Splunk, endpoint telemetry with Sysmon, network detection with Snort, and controlled security testing.
I have expanded my hands-on work into endpoint detection and response and security automation, including n8n-based automated incident triage and Splunk HEC integration.
Infrastructure Security
Active Directory, pfSense, network segmentation, firewall rules, DNS, access control, and enterprise troubleshooting.
Cloud & Identity
AWS, VPC, EC2, IPsec, Microsoft Entra ID, Microsoft Entra Connect, and hybrid identity.
Endpoint Security
Endpoint telemetry, process behavior, alert triage, investigation, containment concepts, and response workflows.
Security Automation
n8n, webhooks, JSON processing, alert normalization, severity routing, incident enrichment, Splunk HEC, response validation, and failure handling.
Networking
TCP/IP, subnetting, routing, VPNs, Wireshark analysis, VMware networking, and connectivity troubleshooting.
Featured Projects
Hands-on infrastructure and cybersecurity projects demonstrating enterprise administration, networking, cloud, identity, security monitoring, access control, testing, and troubleshooting.
ENTERPRISE SOC
Enterprise Active Directory & SOC Project
Built a segmented Windows enterprise environment using Active Directory, multiple domain controllers, Group Policy, pfSense, Splunk Enterprise, Sysmon, Snort IDS, and controlled security testing.
HYBRID CLOUD
AWS Hybrid Cloud Infrastructure
Designed an AWS VPC and securely connected it to an on-premises VMware infrastructure through pfSense using redundant IPsec Site-to-Site VPN tunnels.
HYBRID IDENTITY
Microsoft Entra ID Hybrid Identity
Extended an on-premises Active Directory environment into Microsoft Entra ID and implemented hybrid identity using Microsoft Entra Connect Sync.
REMOTE ACCESS SECURITY
Secure IKEv2 Remote Access VPN
Designed, implemented, and validated secure remote access using pfSense, IKEv2/IPsec, Windows clients, network segmentation, least-privilege firewall rules, split tunneling, and Splunk authentication monitoring.
ENDPOINT DETECTION & RESPONSE
CrowdStrike EDR
Deployed and validated CrowdStrike Falcon across four Windows endpoints, configured host groups, prevention and sensor update policies, investigated controlled PowerShell detections, mapped activity to MITRE ATT&CK, reviewed Next-Gen SIEM telemetry, configured Fusion SOAR workflows, and tested network containment and recovery.
SECURITY AUTOMATION
Security Automation & Automated Incident Triage
Built an end-to-end SOC automation workflow using n8n and Splunk HEC to receive security alerts, normalize and validate event data, route incidents by severity, enrich alerts with MITRE ATT&CK and analyst context, forward structured incidents to Splunk, validate responses, and handle delivery failures.
Technical Skills
Systems Administration
Windows Server 2016, 2019 & 2022, Active Directory Domain Services, domain controllers, AD replication, DNS, DHCP, Group Policy, users and groups, Organizational Units, file services, NTFS/share permissions, VMware, and Windows administration.
Networking & Infrastructure
TCP/IP, IPv4, subnetting, LAN/WAN networking, routing, DHCP, NAT, network segmentation, pfSense, firewall rules, access control, IPsec, Site-to-Site VPN, Remote Access VPN, Wireshark, and VMware networking.
Cybersecurity & SOC
Splunk Enterprise, Universal Forwarder, SPL searches, dashboards, alerts, Sysmon, Snort IDS, Windows Security Events, centralized logging, detection engineering, threat investigation, vulnerability assessment, firewall validation, security hardening, and incident response.
Endpoint Security & EDR
Endpoint telemetry, process and network activity analysis, behavioral detection concepts, alert triage, investigation workflows, containment concepts, persistence analysis, authentication telemetry, and response workflows.
Security Automation
n8n, webhook ingestion, JSON processing, alert normalization and validation, severity-based routing, incident enrichment, MITRE ATT&CK context, Splunk HEC integration, response validation, failure handling, and automated incident triage.
Cloud & Identity
AWS, EC2, VPC, IAM, S3, CloudTrail, CloudWatch, Microsoft Entra ID, Microsoft Entra Connect, hybrid identity, and identity and access management.
Certifications & Training
Technical training across networking, cybersecurity, cloud computing, SOC operations, and infrastructure.
Computer Systems Technician – Networking
Ontario College Diploma
CCNA: Enterprise Networking, Security, and Automation
Course Completion Certificate
Google Cybersecurity
Professional Certificate
SOC Level 1
Certificate
Cloud Essentials
AWS Knowledge: Cloud Essentials training badge
Deep Web & Cybersecurity
Certificate
Cybersecurity Specialist
Professional Certificate
Networking Projects
Routing, switching, subnetting, packet analysis, connectivity testing, and troubleshooting.