Kurt Sooknanan Open to internships and co-ops

Security analyst at UMass Boston's Network Security Operations Center. Undergraduate LLM security researcher.

KurtSooknanan

Exploring the intersection of cybersecurity engineering, offensive AI security, and large language model vulnerability research.

Explore my work View research GitHub (opens in a new tab) Contact

Specializations 02 / 08

Where I spend my time

Defensive operations by day, offensive research the rest of the time. The through line is understanding how systems actually fail, and how you catch it when they do.

  • SOC

    Security operations

    Alert triage in a cloud-native SIEM, phishing investigation, and incident write-ups mapped to MITRE ATT&CK.

  • NET

    Network security

    Network+ certified, with VLAN migration work on campus switches and DNS, DHCP, and IPAM training.

  • LLM

    AI and LLM security research

    Guardrail testing with garak and PyRIT, weight-editing experiments, and prompt-injection threat modeling.

  • RED

    Red teaming

    Automated LLM red-team campaigns, the red team side of an NSOC tabletop exercise, and RF work on an air-gapped bench.

  • VULN

    Vulnerability assessment

    Agent-based scanning across 185+ endpoints and remediation plans prioritized by severity and exploitability.

  • PY

    Python security tooling

    Standard-library network utilities, scan orchestration, and automation for research pipelines.

Featured work 03 / 08

Research and engineering

Two projects from my work with the Machine Psychology Group's Cyberpunk Division at UMass Boston. See all projects

In active development

BadToken HYDRA

Automated LLM red-teaming framework

HYDRA is the engine inside BadToken: a scheduler and a shared evidence format that run garak, PyRIT, and a browser-based web module as one automated campaign, so every finding lands in one record you can compare and re-run. Step through a run

  • ~20,000-prompt baseline across 20 garak probe families on a locally served model
  • Results contextualized against a 23-model calibration baseline
  • Pinned vLLM serving stack on A100 nodes so runs reproduce
Read the case study
BadToken HYDRA architecture The HYDRA engine schedules attacks through three modules (garak, PyRIT and WebRedTeam, with X-Ray planned) against locally served models and LLM-backed web apps. Every module writes into one shared evidence record that produces a single findings report. engine HYDRA Scheduler module, attack, target Evidence format one record per finding attack modules garakProbe library (NVIDIA) PyRITMulti-turn orchestration (Microsoft) WebRedTeamBrowser-based web testing X-RayPlanned module targets Locally served LLMs vLLM on A100 nodes, Slurm LLM-backed web apps Lab-hosted test instances Shared evidence record every module writes here, so one campaign produces one comparable findings report
In progress

WebRedTeam

HYDRA's browser-based web module

Text-only scanners can't see what happens after a model's output reaches the browser. I'm extending the WebRedTeam black-box testing framework into a HYDRA module that tests whether prompt injection in page content can escalate into script execution in LLM-backed web apps.

Read the case study
untrusted page content model output rendered as HTML

Illustration of the vulnerability class, not a WebRedTeam screenshot

Security operations 04 / 08

Inside the NSOC

Junior Security Analyst at the University of Massachusetts Boston Network Security Operations Center since June 2026. I monitor, investigate, and remediate security events across campus systems.

185+endpoints under agent-based vulnerability scanning
12+security tools in daily use

See how I work an alert

Full experience

Security monitoring

Work the alert queue in a cloud-native SIEM and decide what needs a closer look.

Detection and response

Remediate endpoint threats with an enterprise EDR platform, including pre-deployment readiness checks.

Incident investigation

Supervisor-facing written findings mapped to MITRE ATT&CK, with IOCs checked against threat intelligence.

Email security

Reported phishing and smishing: header analysis, URL reputation, and DMARC/SPF review across the mail chain.

Vulnerability management

Agent-based scanning across 185+ endpoints, asset tagging, and prioritized remediation proposals.

Network and identity

VLAN configuration during a campus switch migration; AAA, SSO, Kerberos, and SAML fundamentals from NSOC training.

Skills and technologies 05 / 08

The toolkit

Enterprise products are described by category. Naming an employer's security stack in public isn't my call to make.

Security operations

Day-to-day work in the NSOC alert queue.

SIEM triageEDR / XDRPhishing analysisEmail header analysisDMARC / SPFThreat intelligenceSandbox analysisMITRE ATT&CKIOC correlationITSM ticketingDHS-format incident reportsCompTIA Security+ (SY0-701)

Research and accomplishments 06 / 08

On the record

Published writing, research milestones, and recognition. See publications

  • Publication

    Anatomy of a Phishing Attack

    First author. Published through UMass Boston, drawn from NSOC casework.

    Published
  • Manuscript

    BadToken research manuscript

    First author. Covers the before-and-after weight-editing study run through BadToken HYDRA.

    In preparation
  • Research

    ~20,000-prompt baseline scan

    20 garak probe families against a locally served model, with hit logs reviewed by hand to separate real guardrail failures from compliance markers.

    Complete
  • Honor

    Dean's List

    University of Massachusetts Boston, 2026.

    2026
  • Honor

    President's Award for Educational Excellence

    U.S. Department of Education, 2024.

    2024

Certifications 07 / 08

CompTIA Security+

Certified
Issued by
CompTIA
Exam
SY0-701
Earned
Expires

Threats, security architecture, operations, and governance. It builds on CompTIA Network+ (exam N10-009), earned . Long-term goal: CISSP.

All certifications View digital badge (opens in a new tab)
Issued by CompTIA

Security+

Exam
SY0-701
Earned
Nov 2026
Holder
K. Sooknanan

Contact 08 / 08

Let's talksecurity.

I'm looking for internships, co-ops, and research collaborations in security operations, network security, and AI security. Based in the Boston area and open to relocating.

Emailmanny.kurt@gmail.com
GitHubkurt-sudo420
(opens in a new tab)
LinkedInKurt Sooknanan
(opens in a new tab)