Sohan Hossain

· Spearheaded technical audits and documentation efforts to achieve and maintain ISO 27001 and Cyber Essentials certifications, ensuring 100% alignment with international security standards. Authored and enforced comprehensive corporate security policies—including Password, VPN, and BYOD to standardise security protocols and reduce human-centric risk factors. · Conducted end-to-end internal and external network penetration tests to identify critical infrastructure weaknesses and simulate real-world attack vectors. Directed the full lifecycle of vulnerability management, from initial discovery to validated remediation, significantly reducing the organization’s attack surface. · Achieved a 43% increase in security posture by implementing rigorous system hardening across some corporate devices. Developed and deployed both manual configuration and PowerShell scripts to automate CIS and Microsoft Benchmark configurations, ensuring consistent, scalable, and error-free security baselines.

Conducted Risk Assessments to identify potential threats to business processes and IT systems, client advisory scenarios. Reviewed Software Development Lifecycle (SDLC) processes and developed targeted walkthrough questions to assess project compliance and control effectiveness. Created a Controls Testing Summary Presentation, synthesizing audit findings and presenting control gaps and recommendations to client audience.

Conducted detailed analysis of web activity logs to identify unusual patterns and potential security threats. Assisted a high-profile client during a cyber security breach, leveraging insights to mitigate risks and secure sensitive data. Responded to inquiries regarding suspicious user activity, enhancing the client's overall cyber threat detection capabilities.

Collaborated on Identity and Access Management (IAM) initiatives, resulting in a 20% increase in operational efficiency. Developed and maintained comprehensive IAM documentation, leading to a 25% improvement in compliance adherence. Translated complex technical information for stakeholders, facilitating better collaboration and more informed decision-making.

Responding to a malware attack as a SOC analyst. Analyzing the attack (Technical) from firewall logs. Mitigate the malware attack (creating firewall rules in Python scripting). Incident Postmortem report writing.

Conducted thorough Risk Assessments and Vulnerability Analyses, identifying and mitigating security threats within company infrastructure Developed Security Policies and Plans, including password, data usage, VPN policies, Business Continuity Plans, and incident response plans to establish clear guidelines for employees and stakeholders and promote adherence to best security practices Implemented security awareness programs, educating employees on phishing, strong passwords, and cybersecurity best practices Execute the implementation of information security principles and processes, ensuring the safeguarding of sensitive data.

Conducted comprehensive penetration testing using Nmap and Metasploit to perform scanning, enumeration, and exploitation of potential vulnerabilities. Employed SQL injection techniques to assess database security and identify potential points of vulnerability. Identified critical vulnerabilities such as anonymous FTP access, lack of HTTPS encryption, easy access to the database using SQL injection, and open remote desktop services. Collaborated with stakeholders to implement remediation strategies, including the disabling of anonymous FTP access, implementing VPN for remote connection and the enforcement of stronger password policies.

Key Modules: Ethical Hacking, Databases, Risk and Vulnerability Assessment, Security Architecture and Future Trends, Security Management, Communication and Security Protocols, Digital Forensic Investigation. Skills Earned: Hands on experience of Penetration testing and report writing. Conducted thorough third-party risk assessments, identifying and addressing potential vulnerabilities, resulting in enhanced security posture and resilience. Developed and implemented information security policies and procedures, ensuring compliance with industry regulations and standards (ISO 27001, NIST, GDPR etc). Accomplished Real time project using Matlab, Python, C#, Encase, Kali Linux.