Joshua Sumwalt

Skilled Security Analyst specializing in vulnerability assessment, risk identification, and security controls validation. Certified in CompTIA Security+, with a strong foundation in risk management and network security. Expertise in identifying security weaknesses and evaluating risk impact to support effective remediation efforts.

• CompTIA Security+
• Information Technology Certificate – CPCC
• Cybersecurity Certificate – CPC

• Detected and validated a reverse shell attack between Ubuntu and Kali Linux using network traffic capture and endpoint analysis., Captured malicious traffic using Wireshark/tcpdump, identifying TCP connection to attacker host on port 4444., Correlated network indicators with endpoint evidence using Linux tools (ss, ps) to identify the bash process initiating the connection., Confirmed attacker IP, victim IP, and active session to validate command-and-control style behavior., Demonstrated host + network correlation techniques used in incident analysis and threat investigation.
• Performed a vulnerability scan of a Windows 11 system using Tenable Nessus Essentials., Identified medium-severity misconfiguration (SMB Signing Not Required) exposing system to man-in-the-middle / SMB relay attacks., Evaluated risk impact and attack scenario, including credential interception and traffic manipulation risks., Documented remediation actions, including enforcing SMB signing via Windows security policy., Demonstrated vulnerability identification, risk prioritization, and remediation guidance.
• Deployed a Splunk Enterprise SIEM environment on Ubuntu and ingested Windows authentication logs using Splunk Universal Forwarder., Queried and analyzed Windows Event IDs 4624 (success) and 4625 (failed logons) using Splunk SPL queries., Built time-based analysis of failed logons to detect abnormal authentication spikes and potential brute-force activity., Analyzed authentication activity by host to identify source systems generating failed login attempts., Investigated authentication metadata fields including account name, logon type, source IP, and workstation., Applied MITRE ATT&CK technique T1078 (Valid Accounts) for detection mapping and security monitoring alignment.