Kurt Sooknanan Open to internships and co-ops

Experience

Experience

Day-to-day security operations in the university's Network Security Operations Center, LLM red-team research in the Machine Psychology Group, and the retail systems job that came first.

Jun 2026 to present

Junior Security Analyst, NSOC

Network Security Operations Center, University of Massachusetts Boston. I monitor, investigate, and remediate security events across campus systems using SIEM, vulnerability management, and endpoint tooling.

185+endpoints under agent-based scanning
12+security tools in active use

What you won't find here: incident details, internal tool names, or anything about the university's environment. Tools are described by category, and I'm glad to go into specifics in an interview.

Security monitoring

Work the alert queue in a cloud-native SIEM and decide what needs a closer look.

Detection and response

Remediate endpoint threats with an enterprise EDR platform, including pre-deployment readiness checks.

Incident investigation

Supervisor-facing written findings mapped to MITRE ATT&CK, with IOCs checked against threat intelligence.

Email security

Reported phishing and smishing: header analysis, URL reputation, and DMARC/SPF review across the mail chain.

Vulnerability management

Agent-based scanning across 185+ endpoints, asset tagging, and prioritized remediation proposals.

Network and identity

VLAN configuration during a campus switch migration; AAA, SSO, Kerberos, and SAML fundamentals from NSOC training.

Case walkthroughs

How I work an alert

Three kinds of case from the queue, replayed one stage at a time. Every value is invented: the domains, addresses, hostnames, and counts don't exist anywhere.

Illustrative walkthrough

Synthetic data

  1. Signal

    A user reports a suspicious message

    A staff member uses the report button on an email asking them to review a shared document. Reports like this are the cheapest detection there is, so each one gets a real look.

    source
    user report
    subject
    Shared file: Q3 budget review
    sender
    accounts@billing-notice.example
    queue
    email security

  2. Triage

    Read the headers before the body

    The display name imitates an internal department, but the sending domain doesn't belong to the university and the Reply-To points somewhere else again. Authentication results settle it.

    Decision Not a false report. Treat as phishing and keep going.

    spf
    fail
    dkim
    none
    dmarc
    fail
    reply-to
    mismatch with sender

  3. Enrich

    Find out what the link does

    The URL is checked against threat intelligence, then opened in a sandbox rather than on a workstation. A recently registered domain serving a copy of a sign-in page is credential phishing, not spam.

    Decision Credential harvesting confirmed. Scope it.

    url
    hxxps://docs-share[.]example/view
    domain age
    4 days
    reputation
    flagged
    sandbox
    fake sign-in page

  4. Scope

    Find everyone else who got it

    One report rarely means one recipient. A message trace shows who else received it and who clicked, and sign-in activity for those accounts gets reviewed next.

    Decision Two accounts need follow-up. The rest need the message removed.

    recipients
    14
    clicked
    2
    credentials entered
    1 suspected
    related cases
    unusual sign-in

  5. Respond

    Contain it, inside the runbook

    The message is removed from mailboxes, the sender and URL are blocked, and affected accounts get a password reset with sessions revoked. Anything outside my permissions goes to a senior analyst with the evidence attached.

    message
    removed
    sender and url
    blocked
    accounts
    reset, sessions revoked
    escalation
    senior analyst

  6. Record

    Write it up so the next analyst can use it

    Findings go into the ticket mapped to MITRE ATT&CK, with indicators listed so they can be searched later. If the same lure shows up again, the second case starts from this one.

    technique
    T1566.002 Spearphishing Link
    indicators
    1 domain, 1 url, 1 sender
    ticket
    closed with findings

This shows method, not history. It isn't a record of any real incident, and it leaves out how the university's environment is configured.

All roles

Timeline

Most recent first.

  1. Jun 2026
    Present

    Junior Security Analyst

    Network Security Operations Center / University of Massachusetts Boston

    • Incident investigation: triage and document incidents in a cloud-native SIEM, from initial alert review through supervisor-facing written findings mapped to MITRE ATT&CK.
    • Email and phishing analysis: investigate reported phishing and smishing through header analysis, URL reputation checks against threat-intelligence platforms, and social-engineering indicator review; work the inbound mail chain including transport rules, ATP scanning, AI-based behavioral detection, and DMARC/SPF.
    • Vulnerability management: run agent-based scanning across 185+ endpoints, asset-tag by hostname and IP, schedule scans, and write remediation proposals prioritized by severity and exploitability.
    • Network infrastructure: configured VLANs on campus switches during a migration from legacy switches to new hardware; completed DDI (DNS, DHCP, IPAM) lab training.
    • Endpoint security: remediate endpoint threats with an enterprise EDR platform, including pre-deployment readiness checks that confirm provisioning software and agent enrollment before machines ship.
    • Red team exercises: lead the red team side of an NSOC security tabletop exercise.
    • Reporting: track findings in an ITSM ticketing platform and author incident reports in DHS format, with IOCs cross-referenced against threat intelligence.
    • Writing: first author of “Anatomy of a Phishing Attack,” published through UMass Boston and drawn from NSOC casework.

  2. Jul 2026
    Present

    Undergraduate LLM Security Researcher

    Machine Psychology Group, Cyberpunk Division / University of Massachusetts Boston

    Undergraduate Machine Psychology Fellow, advised by Daniel Haehn, PhD, Department of Computer Science. Adversarial security testing of large language models and embedded devices.

    • BadToken HYDRA: building an automated red-teaming framework whose engine schedules garak, PyRIT, and a browser-based web module behind one shared evidence format.
    • Red-team scanning: ran a ~20,000-prompt baseline across 20 garak probe families against a locally served model, then analyzed hit logs to separate real guardrail failures from compliance markers.
    • Experiment design: leading a before-and-after weight-editing study testing whether resistance is refusal-mediated or capability-mediated, with encoding probes as a control and Z-scores against a 23-model calibration baseline.
    • Research infrastructure: serve models with vLLM on A100 nodes under Slurm; maintain pinned CUDA/PyTorch environments and the group's cluster documentation.
    • Hardware track: embedded device and wireless testing on an isolated, faculty-supervised bench.
    • Writing: first-author manuscript in preparation.

    Visit the research lab

  3. Jun 2024
    Aug 2026

    Service Supervisor

    Cumberland Farms / Retail operations

    Ran store operations day to day, with considerably more IT and systems work than the title suggests.

    • Infrastructure: maintained the store's data cabinet (routers, switches, patch panels) so the network stayed up for POS, fuel systems, and back-office operations.
    • Troubleshooting: resolved POS client-to-server polling failures and database sync errors, isolating hardware from network from software before escalating.
    • Leadership: led shifts as key holder, onboarded staff on store systems, and handled escalations under pressure.