Skip to content

Raghav Mahajan

Web developer + SOC analyst

Status: Open to SOC roles

Edmonton 53.5461° N / 113.4938° W

Local --:--:-- · Session 00:00:00

Raghav Mahajan, black-and-white portrait

Subject: Raghav Mahajan — Edmonton, AB

TryHackMe SOC L165%
Microsoft SC-200In progress

Raghav
Mahajan

I investigate attacks in a four-node home SOC lab and document every run. Open to SOC roles across Canada.

↑ Recruiters: the resume is one click. No form. No funnel.

By day, Raghav builds websites for small businesses. By night, he hunts intruders in a home SOC lab. Currently open to SOC analyst roles anywhere in Canada.

Subject
Raghav Mahajan
Based
Edmonton, AB
Languages
English, Hindi, Punjabi, Urdu
Distinguishing marks
Runs a 4-node Wazuh lab at home
Blue Team Brief newsletter cover, Edition 4

Blue Team Brief. His plain-English cybersecurity newsletter. Written, designed, and shipped by the subject. 284 subscribers and counting.

Exhibit B · Captured — lab attack, Oct 14, 2026

wazuh — docker-soc — alerts.log
Homelab — live captureWazuh 4.9 · Docker SOC
** Alert 1791978824.294411: - syslog,sshd,authentication_failed,
2026 Oct 14 02:13:44 DC-01->/var/log/auth.log
Rule: 5710 (level 5) -> 'Attempt to login using a non-existent user'
Src IP: 192.168.56.102  User: (invalid user) admin  Decoder: sshd
** Alert 1791978831.294455: - syslog,sshd,authentication_failed,
2026 Oct 14 02:13:51 DC-01->/var/log/auth.log
Rule: 5712 (level 10) -> 'SSH brute force attack detected'
Src IP: 192.168.56.102  User: (invalid user) admin  Decoder: sshd
** Alert 1791978903.294512: - syslog,pam,authentication_failed,
2026 Oct 14 02:15:03 WEB01->/var/log/auth.log
Rule: 5503 (level 5) -> 'PAM: User login failed.'
Src IP: 10.143.0.67  User: rmahajan  Decoder: pam_unix
** Alert 1791978960.294601: - ossec,

Read the investigation →

What Raghav actually does

Web builds

Full sites for small business clients: design, build, hosting, the lot. His estimator quotes a project in about a minute, at 45% of typical market rates, and every quote lands in his own CRM. No agency, no handoffs, you talk to the person writing the code.

Security operations

Corporate security site supervisor work, plus a home lab that runs real attacks against real tooling: Wazuh, Splunk, Hydra brute force, lateral movement tests, then a written incident report for every run. Triage, documentation, and follow-through are the job, not the side quest.

Note: the log above is not a tutorial screenshot.
Every alert in it came from an attack he ran himself.

The price machine

$4,000
$1,800

Typical market quote vs. his price, same scope.

Six questions. A real range, on screen, in about a minute. His price is 45% of market on the build, and the quote goes straight into his pipeline, so a human answers fast.

Fixed quote

Set at signing, in the agreement

40 · 40 · 20

Signing, design approval, launch

No GST

Small supplier: it is not charged

Net 14

Invoices due fourteen days after issue

How a build runs

01

STEP 01 / 03

Scope and fixed quote

The estimator sets the range, a short questionnaire pins the scope, and the quote is fixed when you sign. The number in the agreement is the number you pay.

02

STEP 02 / 03

Build, on the 40-40-20 split

40% at signing, 40% when the design is approved. You watch the build happen in your client portal instead of waiting for a reveal at the end.

03

STEP 03 / 03

Launch and handover

The final 40% lands at launch, the site goes live on your domain, and a 30-day warranty covers defects from day one.

Questions, answered straight

His price is 45% of the typical market quote for the same scope. Run the estimator and you get a real range in about a minute; the exact figure is then fixed in the agreement before any money moves.

Credentials, verified

CompTIA Security+
CompTIA · expires Jun 2029
SY0-701CompTIA Security+ certificate, SY0-701
ISC2 Certified in Cybersecurity
ISC2 · CC
CCISC2 Certified in Cybersecurity certificate, number 4332427
Google Cybersecurity
Google · three course certificates
2026Google Foundations of Cybersecurity certificate
Intermediate First Aid
APEX · CSA Z1210-17 · expires Oct 2029
10748425Intermediate First Aid certificate, certificate number 10748425
Microsoft SC-200
Microsoft · Security Operations Analyst
SC-200In progress

Open the full credential list →

Google Foundations of Cybersecurity certificate issued to Raghav Mahajan, January 8, 2026
The document itself. The actual certificate, not a badge icon. Google, Foundations of Cybersecurity, issued Jan 8, 2026. Verify code RMT26QI2LCT7, printed on the document itself.

The documents, examined

Google Foundations of Cybersecurity certificate issued to Raghav Mahajan, January 8, 2026
Google Foundations of Cybersecurity. Issued Jan 8, 2026 · Verify code RMT26QI2LCT7, printed on the document
CompTIA Security+ certificate, SY0-701
CompTIA Security+ · SY0-701. Certified Jun 15, 2026 · Expires Jun 15, 2029
ISC2 Certified in Cybersecurity certificate, number 4332427
ISC2 Certified in Cybersecurity (CC). Certification 4332427 · Cycle Jul 2026 to Jun 2029

Contents