Ian Buquid

CompTIA CySA+, Security+, Network+, and A+ certified SOC professional with hands-on experience in SIEM monitoring, incident triage, threat intelligence, vulnerability management, and detection engineering. Skilled in Splunk, Microsoft Sentinel, IBM QRadar, and Wazuh, with practical experience investigating Windows and network telemetry, enriching indicators of compromise, building detections, and documenting response procedures. Brings strong analytical judgement, stakeholder communication, and prior healthcare experience to security operations in regulated environments.

Cyber Security Consultant, SOC & Threat Intelligence - AMDARI - United Kingdom

(2024-04)

• Monitor SIEM, IDS/IPS, endpoint, and firewall alerts across four security telemetry layers to identify anomalous behaviour, suspicious activity, and potential compromise.
• Triage, classify, document, and escalate security incidents using defined response procedures, supporting risk-based prioritisation and clear analyst handover.
• Correlate authentication, application, endpoint, and firewall telemetry across Splunk, Microsoft Sentinel, Wazuh, and IBM QRadar to identify attack patterns and reduce duplicate investigative effort.
• Enrich investigations using MISP, VirusTotal, and AlienVault OTX to validate indicators of compromise, review attacker tactics, and provide threat context for response decisions.
• Assess vulnerabilities using Nessus and OpenVAS, prioritise findings by severity and business impact, track remediation actions, and produce reports for technical and non-technical stakeholders.

Network Security Associate - IB TECH WIRELESS SOLUTIONS - Philippines

(2020-01 - 2022-04)

• Configured and maintained routers, switches, and firewalls to support secure, reliable connectivity across business network infrastructure.
• Monitored network performance and investigated connectivity incidents, restoring service and reducing disruption to business users.
• Applied firewall policies and access control lists to restrict unauthorised traffic, limit exposure, and support network security governance.
• Maintained network diagrams, operational logs, and technical reports to improve troubleshooting, incident response, and upgrade planning.
• Supported firmware upgrades, capacity reviews, and IP utilisation checks to maintain stable, secure, and well-governed network operations.

Diploma - Cyber Security Programme, CompTIA Courses - IT Online Learning Ltd.

Diploma - Midwifery - Naga College Foundation