Onur Akcakaya CYBER OPERATIONS & RESILIENCE
HOME ↗ INSIGHTS ↗ CAREER ↗ LINKEDIN ↗ GITHUB ↗ CYBER DASHBOARD ↗ ARCHIVE ↗ PORTFOLIO ASCENT
▎ OPERATOR
UNREGISTERED
tasks: 0/0 hours invested: 0 hours remaining: 0 last save: —
00% MISSION

// op.portfolio_ascent

SESSION 0x4A · CLASSIFICATION: PUBLIC · CLEARED FOR DEPLOY
node: recruiter_radar target: github.com/you objective: get_hired_fast status: ARMED

Register your call sign. Progress saves automatically to this browser. If you've registered before on this machine, your data loads on refresh.

Awaiting input…
▎ MISSION BRIEFING ▎ READ IN FULL

build a github
that hunts
recruiters for you.

Your GitHub is your operating theater. Hiring managers don't read résumés the way they read repos. They scan, they click, they look for evidence. This guide turns your profile into a portfolio that proves what a PDF can only claim.
analyst@home:~$ whoami → cyber operations professional. data scientist. certified. credentialed. analyst@home:~$ cat ./goal.txt → a github so functional that recruiters race to my inbox. analyst@home:~$ begin --plan
PHASE_01

Foundation — make the profile itself a credential

WEIGHT: 8% · ~6 hrs
01 / SETUP

Professional handle

Use your real name or a clean variant. Recruiters cross-reference LinkedIn, GitHub, and your résumé — they must match.

02 / VISUAL

Headshot + banner

Real photo. Clean banner — dark theme, your specialization in 3 words. Avoid stock hacker hoodies.

03 / BIO

One-line value prop

Format: "[Role] · [Specialty] · [Proof]". Example: "Cyber Ops Analyst · Threat Detection & ML · Security+, CySA+, MS Data Science".

04 / README

Profile README repo

Create a repo named exactly your username. The README.md renders on your profile page.

05 / PINS

Pin 6 strongest repos

Mix: 2 cyber, 2 data science, 1 automation, 1 writeup. Order by impact, not date.

06 / HYGIENE

Kill the noise

Archive or delete old class assignments, broken forks, "hello world" repos. Curate ruthlessly.

07 / CONTACT

Make hiring easy

Pin email, LinkedIn, and a Calendly link in the profile README.

08 / CONSISTENCY

Green squares matter

Aim for 3–5 days/week. Discipline, not raw output.

PHASE_02

Repository architecture — every repo tells the same story

WEIGHT: 4% · ~3 hrs
📁 project-name/ ├── README.md # the sales pitch — see template below ├── LICENSE # MIT or Apache 2.0 — never leave blank ├── .gitignore # language-appropriate, no secrets ever ├── requirements.txt # or pyproject.toml / package.json ├── 📁 src/ # source code, organized by module ├── 📁 notebooks/ # jupyter — cleaned & narrated ├── 📁 data/ # sample data only; never real PII ├── 📁 docs/ # architecture, threat model, ADRs ├── 📁 tests/ # pytest / unittest — even a few matter ├── 📁 .github/workflows/ # CI: lint, test, build, security scan └── 📁 screenshots/ # dashboards, terminal output, diagrams
▸ TASK

Create a template repo

Build one master repo with this structure, mark it as "template" in GitHub settings. Every future project clones from it.

▸ TASK

Reusable CI workflow

One .github/workflows/ci.yml running lint + tests + secret scan. Reuse across repos.

▸ TASK

License decision

Pick MIT or Apache 2.0 as default. Add to template.

PHASE_03

README anatomy — what recruiters actually scan

WEIGHT: 3% · ~2 hrs
# 🛡 Project Title — One Line Outcome
![CI](badge) ![License](badge) ![Python](badge) ![Coverage](badge)

A short paragraph explaining what this does, who it's for, and the measurable outcome. Lead with result, not stack.

## 🎯 Problem
Why does this exist? Cite a CVE, MITRE technique, or real dataset.

## 🏗 Architecture
Embed a diagram (Excalidraw → PNG → /screenshots).

## ⚡ Quickstart
```bash
git clone ...
pip install -r requirements.txt
python -m src.main --config configs/default.yaml
```

## 📊 Results
Detected 94% of simulated lateral movement (n=1,200 events)
False-positive rate: 2.1% on benign baseline
Median alert latency: 1.4s

## 🧠 What I Learned
Honest reflection — recruiters love this section.

## 📚 References
MITRE ATT&CK T1078
Relevant paper / blog / RFC
▸ TASK

Draft your README template

Save the template above as a reusable block in your template repo.

▸ TASK

Configure shields.io badges

Build, license, language, coverage. Copy into top of every project README.

▸ TASK

Screenshot workflow

Standardize capture/crop (Flameshot / CleanShot). Consistency reads as polish.

PHASE_04

Credentials — proof you earned it, not just claimed it

WEIGHT: 10% · ~8 hrs

Build a repo called credentials/ with one folder per cert/degree containing: verification link, study log, lab work, and a writeup of what you actually built with that knowledge.

▸ SECURITY CERTS
Security+, CySA+, Pentest+, CISSP, OSCP, CEH

Each gets: verification badge URL, study notes, 2–3 lab writeups (TryHackMe / HackTheBox / your own VM lab), date earned.

▸ DATA SCIENCE
Degrees, AWS ML, Azure Data, Google Cloud

Pair each with a Kaggle notebook or real analysis. Show the capstone — and the rejected hypotheses.

▸ LICENSES
Professional licenses & clearances

If publicly disclosable, link verification page. For clearance-related items, follow agency disclosure guidance carefully.

▸ ACADEMIC
Degree(s) — coursework receipts

3–5 strongest course projects as standalone repos. Thesis/capstone gets its own polished repo with PDF in /docs.

▸ TASK

Create credentials/ repo

Master index README listing every cert with status (earned / in-progress / planned).

▸ TASK

Document each security cert

Folder per cert: verification link, study log, 2 lab writeups, key concepts.

▸ TASK

Document data science creds

Each paired with a notebook/repo of real analysis you completed.

▸ TASK

Surface your degree(s)

3–5 strongest course projects polished and linked from credentials index.

PHASE_05

Project pipeline — 10 builds that get you hired

WEIGHT: 55% · ~280 hrs

Order matters. Start entry-level, ladder up. The flagship at the bottom gets you past the screen. Each project's checkbox represents shipping it end-to-end — README, diagram, screenshots, the works.

P.01 Home SOC Lab — Build, Detect, Document ENTRY ~15 hrs +
// MISSION

Stand up a virtual SOC: vulnerable Windows/Linux victim, Kali attacker, SIEM stack (Wazuh / Security Onion / ELK). Generate attacks, watch detections fire, document everything.

// DELIVERABLES
  • Architecture diagram (network, hosts, log flow)
  • Reproducible setup (Vagrant / Terraform)
  • 10 attacks mapped to MITRE ATT&CK
  • Detection writeups: alert, data, conclusion
  • Dashboard screenshots of real events
// STACK
VirtualBox/ProxmoxWazuhELKKaliSysmonAtomic Red Team
// WHY RECRUITERS CARE

Proves you understand the full detection lifecycle. Almost every blue-team interview asks "describe your home lab" — this is the answer.

IMPACT LINE: "Built and maintained a virtualized SOC simulating 10+ ATT&CK techniques across Windows/Linux endpoints, with detection coverage documented and reproducible."
P.02 Phishing URL Classifier — ML for Security ENTRY ~18 hrs +
// MISSION

Train a classifier that flags phishing URLs in real time. Public datasets (PhishTank, OpenPhish), engineered features, multi-model benchmark.

// DELIVERABLES
  • Clean notebook: EDA → features → models
  • 3+ models with proper cross-validation
  • Confusion matrix, ROC, precision/recall
  • CLI or FastAPI endpoint scoring URLs
  • Discussion of concept drift / production breakage
// STACK
Pythonscikit-learnpandasXGBoostFastAPIDocker
// WHY RECRUITERS CARE

Ties your DS degree to your security certs. Most common "ML+Sec" hybrid interview narrative.

IMPACT LINE: "Trained an XGBoost phishing URL classifier achieving 96.4% F1 on held-out test set; deployed as containerized FastAPI service."
P.03 CVE Watcher — Automated Vulnerability Intelligence ENTRY ~12 hrs +
// MISSION

Poll NVD for new CVEs, filter by CVSS + product, enrich with EPSS scores, post daily digest to Slack/Discord/email.

// DELIVERABLES
  • Scheduled service (cron / GH Actions / Lambda)
  • Config for products + severity thresholds
  • SQLite store for dedup + history
  • Sample digest screenshots from real week
// STACK
PythonNVD APIEPSSGitHub ActionsSQLite
// WHY RECRUITERS CARE

You can ship and operate something. CI/CD piece signals DevSecOps maturity.

IMPACT LINE: "Automated daily CVE intelligence pipeline filtering NVD feed by 12+ tracked products; runs on GitHub Actions at zero cost."
P.04 Network Anomaly Detection on CICIDS2017 MID ~25 hrs +
// MISSION

Real labeled IDS dataset (CICIDS2017 / UNSW-NB15 / CTU-13). Compare supervised vs unsupervised. Honest about class imbalance.

// DELIVERABLES
  • EDA notebook with traffic + imbalance writeup
  • Reproducible training pipeline
  • Supervised vs unsupervised comparison
  • SHAP / feature-importance analysis
  • Section on adversarial robustness
// STACK
Pythonscikit-learnPyTorchSHAPMLflow
// WHY RECRUITERS CARE

Real benchmark hiring managers recognize. Doing it well separates you from Coursera grads.

IMPACT LINE: "Built supervised & unsupervised NIDS on CICIDS2017; achieved 0.98 ROC-AUC with feature-importance analysis identifying top 5 predictive flow attributes."
P.05 Log Pipeline — Sysmon → Kafka → Detection Rules MID ~28 hrs +
// MISSION

Collect Sysmon/Windows logs, stream through Kafka, apply Sigma rules, route hits to dashboard. Write 5+ of your own Sigma rules.

// DELIVERABLES
  • Docker-compose stack: collector + Kafka + consumer + dashboard
  • 5+ custom Sigma rules with test events
  • Performance: events/sec, alert latency
  • Grafana / Streamlit screenshot in README
// STACK
KafkaSysmonSigmaDockerGrafanaPython
// WHY RECRUITERS CARE

Detection engineering is the highest-leverage SecOps skill. Rules + pipeline together is rare in junior portfolios.

IMPACT LINE: "Engineered end-to-end log pipeline ingesting Sysmon events through Kafka with custom Sigma detections; processed 5k events/sec with sub-second alert latency."
P.06 Malware Triage Dashboard (Static Analysis) MID ~22 hrs +
// MISSION

Take a PE/ELF binary or document, run static analysis (entropy, imports, strings, YARA, hash lookups), produce triage report. Public sandbox samples only — never run live malware outside isolation.

// DELIVERABLES
  • CLI + simple Streamlit/Flask UI
  • 20+ original YARA rules organized by family
  • Risk scoring logic with documented heuristics
  • Safety disclaimer + sandboxing guidance
// STACK
PythonpefileYARAVirusTotal APIStreamlit
// WHY RECRUITERS CARE

YARA fluency is gold for malware/IR. A working UI shows you think about analyst experience.

IMPACT LINE: "Authored 20+ YARA rules and built a static-analysis triage dashboard reducing first-pass review time on suspicious binaries by 60%."
P.07 Threat Intelligence Graph — STIX/TAXII to Neo4j HIGH ~35 hrs +
// MISSION

Ingest STIX 2.1 from MISP / OTX / abuse.ch / OpenCTI, normalize, load into Neo4j. Build queries answering analyst questions: actor infrastructure reuse, IOC overlap.

// DELIVERABLES
  • STIX parser + Neo4j idempotent loader
  • 10+ Cypher investigative queries
  • Graph visualizations in README
  • Mini-investigation writeup on real data
// STACK
PythonSTIX/TAXIINeo4jCypherMISPOpenCTI
// WHY RECRUITERS CARE

CTI and threat-hunting teams live in graph data. Most candidates never touched Neo4j — instantly top decile.

IMPACT LINE: "Built a threat-intel graph ingesting 4 STIX feeds into Neo4j (200k+ nodes); authored 10 Cypher queries surfacing actor infrastructure reuse patterns."
P.08 Adversarial ML — Evading Your Own Classifier HIGH ~32 hrs +
// MISSION

Take your phishing/malware classifier and attack it. Craft adversarial examples, then defend. Rarest portfolio piece in the field.

// DELIVERABLES
  • Attack notebook: evasion vs perturbation budget
  • Defenses tested: adv training, input squeezing, ensembles
  • Before/after metrics with confidence intervals
  • Discussion linking to real ML evasion research
// STACK
PyTorchCleverHans / ARTFoolboxmatplotlib
// WHY RECRUITERS CARE

AI red-teaming is one of the fastest-growing roles. Breaking + hardening ML systems is senior-level signal.

IMPACT LINE: "Designed adversarial evasion attacks against my phishing classifier (78% bypass at small perturbation budgets); reduced bypass to 12% via adversarial training."
P.09 Cloud Security Posture — IaC Scanner + Remediation Bot HIGH ~38 hrs +
// MISSION

CI tool scanning Terraform / CloudFormation for misconfigurations, commenting on PRs, opening auto-remediation PRs for low-risk fixes.

// DELIVERABLES
  • GitHub App or Action running on every PR
  • 15–20 rules including CIS benchmarks
  • Auto-remediation for 3+ finding types
  • Demo repo with bad IaC + recorded PR comments
// STACK
Python/GoTerraformtfsec-styleGitHub ActionsAWS
// WHY RECRUITERS CARE

Cloud sec + DevSecOps is highest-paying intersection right now. Shipping a working GitHub App is a "call this person" moment.

IMPACT LINE: "Built a GitHub Action scanning Terraform PRs with 20 custom rules; auto-remediates 3 finding classes via opened PRs."
P.10 FLAGSHIP — Purple Team Range with Telemetry & ML Detections FLAGSHIP ~55 hrs +
// MISSION

The capstone. Self-contained range: victim env, automated red-team scripts on schedule, telemetry through your Project 5 pipeline, ML detections from Projects 2 & 4 running on it, live dashboard, CI that rebuilds the whole range on every commit.

// DELIVERABLES
  • One-command deployment (docker-compose / Terraform)
  • 20+ ATT&CK techniques with documented detections
  • Public dashboard URL or recorded demo video
  • Engineering writeup: decisions, breakage, next steps
  • 90-second Loom walkthrough at top of README
// STACK
DockerTerraformAtomic Red TeamKafkaSigmaPyTorchStreamlitGitHub Actions
// WHY RECRUITERS CARE

Proves you operate at the intersection of red, blue, data science, and DevOps. Unicorn profile. Pin it first.

IMPACT LINE: "Architected a fully reproducible purple-team range covering 20+ ATT&CK techniques with ML-augmented detection pipeline; deploys via one command."
PHASE_06

Tradecraft — the things that separate hired from passed-over

WEIGHT: 10% · ~12 hrs
∎ 01
Write like an engineer, not a marketer

Replace adjectives with numbers. "Fast" → "1.4s median latency". Numbers beat enthusiasm.

∎ 02
Pin a writeup, not just code

Deep-dive on one technique (Kerberoasting detection, prompt-injection defenses).

∎ 03
Open-source contributions count double

One merged PR to Sigma / MISP / OpenCTI / Wazuh is worth three solo projects.

∎ 04
Never commit secrets — prove it

Run gitleaks or trufflehog in CI. Badge it.

∎ 05
Record a 90-second demo per flagship

Loom or asciinema. Recruiters share videos in Slack.

∎ 06
Diagrams beat paragraphs

Every nontrivial repo needs an architecture diagram.

∎ 07
Talk about failure

"What I'd do differently" makes you look senior.

∎ 08
Tag releases like a grown-up

SemVer, CHANGELOGs, tagged releases.

∎ 09
Cross-link everywhere

Profile → projects. LinkedIn → GitHub. Résumé → GitHub URLs.

∎ 10
Update one thing a week

30-min weekly "portfolio shift" — README, badge, screenshot.

PHASE_07

90-day execution plan

WEIGHT: 10% · cadence checkpoints
WEEK 1–2

Foundation lockdown

Profile, credentials repo with 2+ certs documented.

WEEK 3–5

Ship Projects 01 + 02

Home SOC + phishing classifier. Polished, diagrammed, pinned.

WEEK 6–8

Ship Project 03 + one mid

CVE Watcher plus one of 04–06.

WEEK 9–11

Ship one HIGH project

Pick 07, 08, or 09 based on target roles.

WEEK 12

Flagship skeleton

Architecture + skeleton repo for Project 10.

ONGOING

Apply while you build

After Projects 01–03 ship, start applying.

// MISSION STATUS: COMPLETE
OPERATION: PORTFOLIO_ASCENT
CERTIFICATE OF COMPLETION
This certifies that
OPERATOR
has successfully completed all 7 phases of the Portfolio Ascent program
and is cleared for deployment.
100%MISSION SCORE
—HOURS INVESTED
—DATE COMPLETED
Issued by Onur Akcakaya · Cyber Operations & Resilience