Available for Opportunities

Daniel
Melendez

Senior Systems & Security Professional | CISSP · CCISO

15+ years in IT and cybersecurity. Bridging technical depth and security leadership — from enterprise infrastructure and identity management to detection engineering and threat intelligence. Based in Durham, NC.

CISSP CCISO Wazuh SIEM Honeypot Operations Threat Intelligence

Technical Skills

🛡️
SIEM & Detection Engineering
Wazuh deployment, custom decoder and rule authoring, OpenSearch dashboards, threat intel pipeline automation via AbuseIPDB.
🍯
Honeypot Operations
Cowrie SSH honeypot deployment on segmented DMZ. Deception environment design with canary credentials and AWS CloudTrail alerting.
🔍
Threat Intelligence
Live attacker analysis corroborated with VirusTotal, GreyNoise, Criminal IP. MITRE ATT&CK mapping and community threat intel contribution.
🔥
Network Security
pfSense firewall rule authoring, NAT configuration, VLAN segmentation, DMZ design on Proxmox hypervisor infrastructure.
☁️
Cloud Security
AWS IAM canary user deployment, CloudTrail logging, CloudWatch alerting, SNS notification pipelines for credential abuse detection.
🤝
Client & Stakeholder Management
10+ years translating technical risk to business outcomes. Proven track record de-escalating critical client situations and mediating vendor relationships.

Recent Honeypot Findings

High

207.154.214.204 — Cryptomining Botnet Fingerprinting

915 connection attempts in 24 hours. Extensive hardware enumeration: CPU model, core count, GPU via lspci, uptime collection, login history. Checks cat/ls help output as honeypot detection technique. Intent: evaluate host resources for cryptominer deployment. ASN AS14061 DigitalOcean — 5th DO IP observed this week suggesting shared botnet infrastructure.

2026-03-14 DigitalOcean DE
High

193.32.162.151 — BEC Phishing Infrastructure SSH Probe

17 vendor detections spanning phishing, malware, and malicious categories. Historical artifacts include SharePoint credential harvesting lures and voicemail social engineering emails consistent with Business Email Compromise campaigns. Hosted on AS47890 Unmanaged Ltd — known bulletproof hosting. Abuse contact is Gmail address. Multiple shell companies registered at same London address indicating layered obfuscation infrastructure.

2026-03-15 Unmanaged Ltd RO
High

80.94.92.184 — Bulletproof Hosting SSH Brute Force

DMZHOST Netherlands infrastructure. 17 vendors malicious. 571 sessions/day against honeypots. Multi-purpose campaign: SSH brute force + phishing. Recommend blocking entire /24 subnet.

2026-03-02 DigitalOcean NL
High

165.245.135.50 — OS Fingerprinting Campaign

373 connection attempts, 370 successful logins. Single payload per session: uname -s -v -n -r -m. Pure inventory building — cataloging targets for later exploitation. Coordinated with 170.64.192.224.

2026-03-02 DigitalOcean US
Medium

46.101.103.24 — Go-Based MySQL Scanner

Custom SSH-2.0-Go scanner targeting mysql system accounts. HASSH fingerprint 2ec37a7cc8daf20b10e1ad6221061ca5. Post-auth GPU/CPU recon consistent with cryptominer staging. Flagged by Cluster25, Criminal IP, GreyNoise.

2026-03-02 DigitalOcean DE
Low

159.203.173.197 — Cryptominer Reconnaissance

OpenSSH Windows client targeting ubuntu/123456. Automated CPU/GPU/architecture enumeration consistent with cryptominer deployment staging. 0/93 VirusTotal but flagged Suspicious by GreyNoise.

2026-03-01 DigitalOcean US

About

CISSP and CCISO-certified security professional with 15+ years of hands-on experience across enterprise infrastructure, identity management, and cybersecurity operations. I bridge the gap between technical depth and security leadership — designing defensible systems, investigating real threats, and translating risk into business outcomes.

Currently operating a home lab with a Cowrie SSH honeypot exposed to the internet, Wazuh SIEM with custom detection rules, automated threat intelligence feeds, and AWS canary credential traps — generating and analyzing real attacker data daily.

My background spans MSP engineering, systems administration, SOC operations, and security architecture — with client-facing experience managing complex infrastructure across multiple industries simultaneously.

15+
Years Experience
163+
Unique Attackers Tracked
10K+
Live Threat IPs in Feed
CISSP
& CCISO Certified

Contact

Open to Senior Systems Administrator, Security Engineer, Security Architect, and cybersecurity consulting opportunities.
Based in Durham, NC. Available for remote and hybrid roles in the Raleigh-Durham area.
Portfolio and threat intel research: techysec.com

[email protected]