Day 1 of being employed in Cybersecurity

TL;DR

I got an internship as IAM Intern in a company called Securentity. I will be posting about my experience and the skills I learnt in future blogs. Yesterday was my first day.

How I got the job

I was actively hunting for LinkedIn posts about internship openings (Search bar -> hit enter -> filter by jobs -> type "we are hiring","cybersecurity intern" and hit enter) and I found out a job posting from this company. And I DMed the recruiter my resume and it got shortlisted, then I was called on site for the interview and I went there, did the interview and got the internship.

I was located in Coimbatore, Tamil Nadu and this company is located in Pune, Maharashtra. I had to travel to Pune for the interview and relocate there for the job.

And also it is a small team so there wasn't any AI based ATS systems automatically rejecting candidates based on experience, that is one of the reasons my resume got shortlisted.

My Background

The role is "IAM intern" and the job is about IAM administration in PingIdentity (for me it is PingIdentity, for some other people it is Entra ID). They weren't expecting much from the interns. I had some hands on experience with Okta, and AWS IAM, and I did some labs in and projects in it that was one of the reasons I was even considered for the job.

I did a JML lab and a SSO-OIDC lab in Okta. Along with a project where I set up IAM role for an EC2 instance to access SSM parameter store values. My story was I was interested in Cloud and Cloud Security and I was doing this project where I had to manage cloud IAM in the scenario I described above, and then through that I got interested in IAM in a broader context and learnt Okta.

Interview Process

The interview wasn't that hard but they asked a lot about programming, Java programming, OOPS, and core IAM concepts. I did not know Java and also I did not know OOPS in a theoretical way. I didn't know answers to half of the questions and I just said "I don't know/I didn't go that deep into it" whenever I didn't know the answers.

Whenever they asked Java OOPS questions I told them how I would write Python code for that scenario as I didn't know Java OOPS. And in the IAM core questions, I knew the answers to half of the questions and I answered them with Okta context, and for what I didn't know I just said I didn't go that deep into Okta.

They were very positive with my interview experience even though I didn't know half of it, and then proceeded to give me the offer letter.

The Job

Yesterday (15th September 2026) was the first day of the job. I work at 11 am to 8 pm (will change) so I am writing this in the morning of today (16th September 2026, my second day, at 11 am) before my job starts.

I was introduced to IAM and told to read about IAM fundamentals from an internal document and today is when the hands on labs start.

Challenges

The biggest challenge I am currently facing in this job is I don't speak Hindi, and all of them do. I am slowly learning it from them and I keep asking the other interns and seniors to translate it whenever I don't understand something.

And also train ticket booking logistics was a huge problem, the tickets weren't available so I had to book in Thatkaal and had to postpone my interview because of that.

My Resume

Here is the Resume I used to get this job in LaTex format, paste this code block in overleaf.com to get a .pdf file.

The one that was shortlisted by the recruiter:

\documentclass[10pt,a4paper]{article}

\usepackage[
a4paper,
left=0.3in,
right=0.3in,
top=0.38in,
bottom=0in
]{geometry}
\usepackage[T1]{fontenc}
\usepackage[utf8]{inputenc}
\usepackage[scaled]{helvet}
\renewcommand{\familydefault}{\sfdefault}

\usepackage{enumitem}
\usepackage{titlesec}
\usepackage[hidelinks]{hyperref}
\usepackage[normalem]{ulem}
\usepackage{xcolor}
\usepackage{tabularx}
\usepackage{array}
\usepackage{setspace}

\setlength{\parindent}{0pt}
\setlength{\parskip}{0pt}
\setlist[itemize]{
leftmargin=15pt,
label=\textbullet,
itemsep=0.2ex,
topsep=0.2ex,
parsep=0pt,
partopsep=0pt
}

\titleformat{\section}
{\fontsize{11}{12}\bfseries}
{}
{0pt}
{}
[\vspace{0em}\titlerule\vspace{0.2em}]

\titlespacing*{\section}
{0pt}
{1.0ex}
{0.4ex}

\begin{document}
\vspace*{-1.5cm}

\fontsize{9.2}{10.6}\selectfont
\begin{center}

{\fontsize{24}{24}\selectfont\textbf{SHOBAN CHIDDARTH}}

\vspace{0.8mm}

% Hyperlinks here
\href{https://linkedin.com/in/shobanchiddarth}{\uline{linkedin.com/in/shobanchiddarth}}
\;
|
\;
\href{https://shobanchiddarth.hashnode.dev}{\uline{shobanchiddarth.hashnode.dev}}
\;
|
\;
\href{https://github.com/shobanchiddarth}{\uline{github.com/shobanchiddarth}}

\vspace{0.3mm}

% Hyperlink here
\href{mailto:[e-mail]}{\uline{[e-mail]}}
\;
|
\;
\href{tel:[phone]}{\uline{[phone]}}

\end{center}

% \vspace{1em}

\section*{PROFESSIONAL SUMMARY}

Security-focused IT student with hands-on experience in security monitoring, SIEM, log analysis, Linux administration, network security, and vulnerability research. Built and operated security-focused home labs to investigate alerts, analyze logs, simulate common attack techniques, and validate detection and response workflows. Experienced in administering and hardening Linux systems, including UFW firewall management, SSH hardening, and endpoint protection, complemented by experience with AWS and Terraform. Strong foundation in network engineering, including TCP/IP, DNS, HTTP, routing, switching, subnetting, and network design. Skilled in technical documentation and a methodical approach to security investigations and troubleshooting.

\section*{CORE SKILLS}

\begin{itemize}
    \item \textbf{Security Operations:} Wazuh SIEM, Alert Triage, Security Monitoring, Log Analysis, File Integrity Monitoring (FIM)
    \item \textbf{Detection Engineering:} SigmaHQ (Sigma Rules)
    \item \textbf{SOAR and Automation:} n8n
    \item \textbf{Network \& Endpoint Security:} pfSense, UFW, Endpoint Protection, AWS Security Groups, AWS NACLs, Cisco IOS ACLs
    \item \textbf{Network Engineering:} TCP/IP, DNS, HTTP, TLS, Routing, Switching, Subnetting, Network Design, Virtual Networking, Wireshark
    \item \textbf{Operating Systems:} Linux (daily driver, server administration, SSH hardening), Windows
    \item \textbf{Cloud \& Infrastructure:} AWS, Terraform (Infrastructure as Code), Docker, VirtualBox
    \item \textbf{Programming \& Automation:} Python, Bash
    \item \textbf{Version Control:} Git, GitHub
\end{itemize}

\section*{SECURITY PROJECTS}

\href{https://github.com/ShobanChiddarth/siem-home-lab-wazuh}{\textbf{\uline{SIEM Home Lab in Wazuh}}}
\textit{
|
SIEM,
Wazuh,
Log Analysis,
Threat Investigation,
VirtualBox,
SOAR,
n8n
}
\begin{itemize}
    \item Deployed a multi-VM Wazuh SIEM environment with Windows and Debian endpoints to centralize security event collection and monitoring.
    \item Configured File Integrity Monitoring (FIM) on Windows and validated real-time detection of unauthorized file modifications via Wazuh alerts.
    \item Simulated SSH brute-force attacks using Hydra, investigated authentication events in Wazuh, and verified automated active response after configured thresholds were exceeded.
    \item Investigated Linux privilege escalation events by analyzing Wazuh alerts generated from sudo-to-root activity.
    \item Designed a segmented dual-pfSense network topology with isolated corporate and attacker networks to support realistic attack simulation and future IDS/IPS integration.
    \item Extended it with SOAR layer for email notifications using n8n whenever files are edited in the folder where File Integrity Monitoring is set up
\end{itemize}

\vspace{0.5mm}

\href{https://github.com/ShobanChiddarth/ettercap-mitm-home-lab}{\textbf{\uline{Ettercap MITM Home Lab}}}
\textit{
|
Ettercap,
Wireshark,
ARP Poisoning,
Packet Analysis,
Man-in-the-Middle (MITM)
}
\begin{itemize}
    \item Performed network reconnaissance to identify the subnet, default gateway, and active hosts before executing an ARP spoofing-based man-in-the-middle attack
    \item Simulated a man-in-the-middle attack using ARP poisoning via ettercap within a controlled VirtualBox environment using ARP spoofing.
    \item Captured and analyzed network traffic with Wireshark, filtering packets by host, IP, protocol, port, and HTTP method for traffic analysis.
    \item Demonstrated credential exposure over unencrypted HTTP traffic through packet analysis.
    \item Documented attack methodology and recommended mitigations for users, organizations, and web application owners.
\end{itemize}

\vspace{0.5mm}

\href{https://shobanchiddarth.hashnode.dev/series/network-engineering-home-lab}{\textbf{\uline{Physical Network Engineering Home Lab}}}
\textit{
|
Linux,
Networks,
SSH,
UFW,
TCP/IP,
Pi-hole DNS,
DHCP
}
\begin{itemize}
    \item Deployed and hardened a headless Linux server with static IP addressing, SSH hardening, and a least-privilege UFW firewall configuration.
    \item Configured Pi-hole as a network-wide DNS resolver and ad blocker with Cloudflare as upstream DNS, blocking 100\% of ads in the network.
    \item Implemented a local public key infrastructure (PKI) using mkcert to enable trusted HTTPS for internally hosted services.
    \item Documented deployment and hardening procedures to support repeatable deployment and ongoing maintenance.
\end{itemize}

\vspace{0.5mm}

\href{https://github.com/ShobanChiddarth/SigmaDojo}{\textbf{\uline{SigmaDojo}}}
\textit{
|
Detection Engineering,
Sigma Rules,
SIEM,
Log Analysis,
Threat Detection,
Splunk SPL,
Microsoft Sentinel KQL
}
\begin{itemize}
    \item Developed a hands-on detection engineering lab platform to help users learn and validate SIEM detection concepts using Sigma rules.
    \item Created and tested Sigma detection rules against synthetic security logs to simulate real-world threat monitoring and investigation workflows.
    \item Implemented rule validation and execution capabilities to identify security events from generated log datasets.
    \item Added Sigma rule translation support to generate Splunk SPL and Microsoft Sentinel KQL queries for different SIEM environments.
    \item Designed simulated attack scenarios and log datasets to demonstrate detection of suspicious activities and improve security monitoring skills.
    \item Built workflows that bridge detection rule development with SOC analyst practices, including log analysis, and threat investigation.
\end{itemize}

\vspace{0.5mm}

\href{https://github.com/ShobanChiddarth/randomised_mac_linux}{\textbf{\uline{MAC Address Randomizer for Linux Desktop}}}
\textit{
|
Linux,
Network Security,
MAC Spoofing
}
\begin{itemize}
    \item Developed a Linux utility that automatically randomizes the network interface MAC address during system startup using macchanger.
    \item Integrated the utility into the Linux boot process to automatically randomize the MAC address at startup, with minimal modifications required for compatibility across init systems.
    \item Applied Layer 2 networking concepts and Linux networking utilities to automate MAC address randomization for improved device privacy.
\end{itemize}

\section*{VULNERABILITY RESEARCH}

\textbf{Responsible Disclosure: IDOR Vulnerability (IIT Bombay's Spoken Tutorial Platform)}

\begin{itemize}
    \item Identified a medium-severity Insecure Direct Object Reference (IDOR) vulnerability by manipulating URL parameters on an authenticated endpoint.
    \item Demonstrated unauthorized access to personally identifiable information (PII), including user names, email addresses, and location data across accounts.
    \item Responsibly disclosed the findings to IIT Bombay's Spoken Tutorial platform and CERT-In, providing technical details to support remediation.
\end{itemize}

\section*{CERTIFICATIONS}

\noindent
\begin{minipage}[t]{0.48\textwidth}
\begin{itemize}[leftmargin=*]
    \item \href{https://www.credly.com/badges/56f915f2-6b5d-4e3b-9188-04e10dea34d0/public_url}{\uline{AWS Certified Cloud Practitioner}}
    \item \href{https://www.credly.com/badges/e2bf3089-d053-4408-9852-57097f0969a8/public_url}{\uline{The Basics of Google Cloud Compute}}
    \item \href{https://www.linkedin.com/learning/paths/docker-foundations-professional-certificate}{\uline{Docker Foundations Professional Certificate}}
\end{itemize}
\end{minipage}
\hfill
\begin{minipage}[t]{0.48\textwidth}
\begin{itemize}[leftmargin=*]
    \item Cisco CCNA (In Progress)
    \item Comptia Security+ (In Progress)
    \item \href{https://www.credly.com/badges/495d0396-80c4-4aa2-ab3a-0431e5d340c6/public_url}{\uline{Google Cybersecurity Professional Certificate}}
\end{itemize}
\end{minipage}


\section*{EDUCATION}

\textbf{Sri Krishna College of Engineering and Technology}
\;|\;
\textbf{B. Tech IT}
\;|\;
\textbf{2023--2027}

% \vfill

\end{document}

The one I physically carried and presented to the interviewers

\documentclass[10pt,a4paper]{article}

\usepackage[
a4paper,
left=0.3in,
right=0.3in,
top=0.38in,
bottom=0in
]{geometry}
\usepackage[T1]{fontenc}
\usepackage[utf8]{inputenc}
\usepackage[scaled]{helvet}
\renewcommand{\familydefault}{\sfdefault}

\usepackage{enumitem}
\usepackage{titlesec}
\usepackage[hidelinks]{hyperref}
\usepackage[normalem]{ulem}
\usepackage{xcolor}
\usepackage{tabularx}
\usepackage{array}
\usepackage{setspace}

\setlength{\parindent}{0pt}
\setlength{\parskip}{0pt}
\setlist[itemize]{
leftmargin=15pt,
label=\textbullet,
itemsep=0.2ex,
topsep=0.2ex,
parsep=0pt,
partopsep=0pt
}

\titleformat{\section}
{\fontsize{11}{12}\bfseries}
{}
{0pt}
{}
[\vspace{0em}\titlerule\vspace{0.2em}]

\titlespacing*{\section}
{0pt}
{1.0ex}
{0.4ex}

\begin{document}
\vspace*{-1.5cm}

\fontsize{9.2}{10.6}\selectfont
\begin{center}

{\fontsize{24}{24}\selectfont\textbf{SHOBAN CHIDDARTH}}

\vspace{0.8mm}

% Hyperlinks here
\href{https://linkedin.com/in/shobanchiddarth}{\uline{linkedin.com/in/shobanchiddarth}}
\;
|
\;
\href{https://shobanchiddarth.hashnode.dev}{\uline{shobanchiddarth.hashnode.dev}}
\;
|
\;
\href{https://github.com/shobanchiddarth}{\uline{github.com/shobanchiddarth}}

\vspace{0.3mm}

% Hyperlink here
\href{mailto:[e-mail]}{\uline{[e-mail]}}
\;
|
\;
\href{tel:[phone]}{\uline{[phone]}}

\end{center}

% \vspace{1em}

\section*{PROFESSIONAL SUMMARY}

Cybersecurity-focused GNU+Linux user with hands-on experience building IAM labs around Okta, Joiner-Mover-Leaver (JML) identity lifecycle management, SSO, OIDC, OAuth 2.0, provisioning, deprovisioning, and group-based access control. Experienced in applying least-privilege principles and validating authentication, authorization, and access revocation workflows through practical security projects. Additional background in AWS IAM, Linux administration, networking, SIEM, detection engineering, Python, Bash, and infrastructure automation, with a strong interest in developing enterprise Identity and Access Management expertise.

\section*{CORE SKILLS}

\begin{itemize}
    \item \textbf{Identity \& Access Management:} Okta, AWS IAM, JML lifecycle, Provisioning, Deprovisioning, Access Control, Least Privilege
    \item \textbf{Authentication \& Authorization:} SSO, OIDC, OAuth 2.0, SAML, RBAC, MFA
    \item \textbf{Security Operations:} Wazuh SIEM, Log Analysis, Threat Detection, File Integrity Monitoring (FIM)
    \item \textbf{Cloud Platforms:} AWS
    \item \textbf{Cloud Security:} AWS IAM Policies, Security Groups, NACLs, CloudTrail, S3 Bucket Policies
    \item \textbf{Automation \& Scripting:} Python, Bash, n8n, FastAPI
    \item \textbf{Infrastructure \& DevOps:} Linux, Docker, Terraform, GitHub Actions, Git, GitHub
    \item \textbf{Networking \& Security:} TCP/IP, DNS, DHCP, Subnetting, Wireshark, pfSense
    \item \textbf{Operating Systems:} Linux, Windows
\end{itemize}

\vspace{0.5mm}

\section{OPEN SOURCE CONTRIBUTIONS}

\href{https://github.com/sigmahq/sigma}{\textbf{\uline{sigmahq/sigma}}}

\begin{itemize}
    \item \href{https://github.com/SigmaHQ/sigma/pull/6118}{\textbf{\uline{PR 6118}}}: Contributed a rule to detect AWS S3 bucket "Block Public Access" settings weakened (bucket made public). One human maintainer approve, one more approval required for merge.
\end{itemize}
\section*{LABS}
\href{https://github.com/ShobanChiddarth/okta-jml-lab}{\textbf{\uline{Okta JML Lab}}}
\textit{
|
Okta,
JML,
RBAC,
IAM,
Provisioning,
Deprovisioning
}
\begin{itemize}
    \item Implemented Joiner-Mover-Leaver (JML) identity lifecycle management in Okta Workforce Identity, automating user provisioning and deprovisioning across three departments and three SaaS applications with zero manual intervention per lifecycle event.
    \item Configured group-based access control policies enforcing least privilege by scoping application assignments strictly to department groups, preventing cross-department access.
    \item Simulated enterprise IAM scenarios including role transitions and employee termination, validating automated access revocation upon account deactivation.
\end{itemize}

\vspace{0.5mm}

\href{https://github.com/ShobanChiddarth/okta-sso-lab-oidc}{\textbf{\uline{Okta SSO Lab (OIDC)}}}
\textit{
|
Okta,
IAM,
SSO,
OIDC,
OAuth 2.0
}
\begin{itemize}
    \item Deployed a PHP web application integrated with Okta as an OIDC Identity Provider, implementing SSO authentication using the OAuth 2.0 Authorization Code flow.
    \item Configured Okta application assignments and access policies to enforce organizational access control.
    \item Validated the end-to-end SSO session lifecycle, including login and logout flows, and documented findings in a technical write-up.
\end{itemize}

\vspace{0.5mm}

\href{https://github.com/ShobanChiddarth/siem-home-lab-wazuh}{\textbf{\uline{SIEM Lab using Wazuh}}}
\textit{
|
SIEM,
Wazuh,
Log Analysis,
Threat Investigation,
VirtualBox,
SOAR,
n8n
}
\begin{itemize}
    \item Deployed a multi-VM Wazuh SIEM environment with Windows and Debian endpoints to centralize security event collection and monitoring.
    \item Configured File Integrity Monitoring (FIM) on Windows and validated real-time detection of unauthorized file modifications through Wazuh alerts.
    \item Simulated SSH brute-force attacks using Hydra, privilege escalation, and File Integrity Damage attacks in a controlled lab environment.
    \item Extended the lab with a SOAR layer using n8n to send email notifications whenever file integrity is damaged in folders monitored by File Integrity Monitoring.
\end{itemize}

\vspace{0.5mm}

\href{https://github.com/ShobanChiddarth/ettercap-mitm-home-lab}{\textbf{\uline{Ettercap MITM Home Lab}}}
\textit{
|
Ettercap,
Wireshark,
ARP Poisoning,
Packet Analysis,
Man-in-the-Middle (MITM)
}
\begin{itemize}
    \item Performed network reconnaissance to identify the subnet, default gateway, and active hosts before executing an ARP spoofing-based man-in-the-middle attack.
    \item Simulated a man-in-the-middle attack using ARP poisoning via Ettercap within a controlled VirtualBox environment.
    \item Captured and analyzed network traffic with Wireshark, filtering packets by host, IP, protocol, port, and HTTP method for traffic analysis.
    \item Demonstrated credential exposure over unencrypted HTTP traffic through packet analysis.
    \item Documented attack methodology and recommended mitigations for users, organizations, and web application owners.
\end{itemize}

\section{PROJECTS}

\href{https://github.com/ShobanChiddarth/telegram-proxy-server-aws}{\textbf{\uline{Telegram Proxy Server on AWS}}}
\textit{
|
AWS,
IAM,
Terraform,
EC2,
SSM Parameter Store,
Least Privilege
}
\begin{itemize}
    \item Implemented AWS IAM workload access for EC2 by creating an IAM role, least-privilege policy, role-policy attachment, and instance profile through Terraform.
    \item Scoped the EC2 role to \texttt{ssm:GetParameter} on a specific SSM Parameter Store resource, restricting application access to only the required secret.
    \item Configured EC2 instances to assume the IAM role through the instance profile and retrieve the SSM parameter at runtime using the AWS CLI without embedding AWS credentials in the workload.
    \item Provisioned the supporting AWS infrastructure with Terraform, including VPC networking, private and public subnets, security groups, Network Load Balancer, and Auto Scaling.
\end{itemize}

\vspace{0.5mm}

\section*{CERTIFICATIONS}

\noindent
\begin{minipage}[t]{0.48\textwidth}
\begin{itemize}[leftmargin=*]
    \item \href{https://www.credly.com/badges/56f915f2-6b5d-4e3b-9188-04e10dea34d0/public_url}{\uline{AWS Certified Cloud Practitioner}}
    \item \href{https://www.credly.com/badges/e2bf3089-d053-4408-9852-57097f0969a8/public_url}{\uline{The Basics of Google Cloud Compute}}
\end{itemize}
\end{minipage}
\hfill
\begin{minipage}[t]{0.48\textwidth}
\begin{itemize}[leftmargin=*]
    \item \href{https://www.credly.com/badges/495d0396-80c4-4aa2-ab3a-0431e5d340c6/public_url}{\uline{Google Cybersecurity Professional Certificate}}
    \item \href{https://www.linkedin.com/learning/paths/docker-foundations-professional-certificate}{\uline{Docker Foundations Professional Certificate}}
\end{itemize}
\end{minipage}


\section*{EDUCATION}

\textbf{Sri Krishna College of Engineering and Technology}
\;|\;
\textbf{B. Tech IT}
\;|\;
\textbf{2023--2027}

% \vfill

\end{document}

Conclusion

The company is very good for growth and learning and everyone treated me well. I plan to become a full time employee here by performing well in this internship.