David MacIas

About David MacIas

Cybersecurity Analyst (SOC) with hands-on experience monitoring, triaging, and responding to security events across enterprise environments. Skilled in analyzing SIEM alerts, correlating logs, and identifying malicious activity to support effective incident response and threat detection. With a foundation built through both operational experience and hands-on lab environments, experience includes vulnerability management, threat hunting, and detection engineering. Daily work focuses on improving detection accuracy, reducing false positives, and enhancing SOC visibility through alert tuning, automation, and threat intelligence integration. Security practices are aligned with frameworks such as MITRE ATT & CK, NIST 800-61, and CIS Controls. In addition to professional experience, a multi-VM cybersecurity lab has been developed and maintained to simulate real-world enterprise environments. This includes Windows Server and Active Directory configuration, Linux administration, network segmentation, VLAN design, firewall implementation, and full log pipeline integration. Hands-on work includes traffic analysis with Wireshark, network scanning with Nmap, and scripting with Python, PowerShell, and Bash to support automation and security operations. As a U.S. Navy veteran, brings a disciplined, detail-oriented mindset with a strong focus on problem-solving, continuous improvement, and mission success. Committed to strengthening security posture through proactive defense, collaboration, and ongoing skill development.

Experience

1. Cyber Security Analyst

   H-E-B

   Dec 2024 — Present · Houston, TX, US

   Monitored network traffic, firewall logs, EDR logs, netflow, IDS/IPS logs and system logs using SIEM(Security Information and Event Management) tools to detect suspicious activity or anomalies.Investigated security alerts by logging levels determine the root cause of breaches, and implementimmediate containment and recovery measures.Worked with various application teams to design, install, implement, architect, configure, and maintainone or more network security management platforms (SIEM, SOAR, NDR) for primarily on-premiseand cloud deployments.Directed and managed incident response activities across all phases (identification, containment,eradication, and recovery) leveraging SIEM and EDR tools to analyze threats and coordinateremediation efforts.Created documentation of the process, guidelines, standards, and technical specifications, as well asdraw network and system architecture diagramsParticipated in regular threat analysis, vulnerability assessments, and risk assessments to identifypotential security gaps.Implemented TCP/IP, networking, routing, ACLs, and network devices.Monitored alerts, validate whether they represent false positives, false negatives, true positive or truenegative on security events, and escalate when appropriate.Tuned and maintain secuirty tools (IDS and SIEM) to reduce false positives and enhance detectionaccuracy.Performed initial triage and investigation of security events and escalate in accordance with incidentresponse procedures.Analyzed and responded to phishing attempts, malware infections, and other suspicious behavior.Utilized threat intelligence feeds (AbuseIPDB, VirusTotal, WHOIS) to contexualize security events, byimproving detection accuracy and supporting proactive threat hunting efforts.Produced reports, both contractual and ad hoc, providing information on events, trends, issues, anddelivering actionable intelligence to federal stakeholders.

Education

• Lone Star College

  Associate of Science - AS, Cybersecurity