SOC Operations
Alert triage, incident handling and escalation with a detection-first mindset — keeping signal high and noise low around the clock.
// Cybersecurity — Security Operations
Tung Nguyen
Cybersecurity
SOC Operations · Red Team / Blue Team · Threat Mapping
I work where offense meets defense: monitoring real environments, mapping how adversaries actually operate, and testing systems the way an attacker would — then turning every finding into stronger detection. Online, I go by MrMeoMeo.
- > SOC Operations
- > SIEM & Detection
- > Threat Mapping
- > Network Traffic Analysis
- > Security Labs
- > Cloud Security
// 01 — Expertise
What I do
The core disciplines I practice — from the SOC floor to the lab, from packets to adversary tradecraft.
SIEM & Detection
Log onboarding, correlation rules and dashboards that turn raw events into detections an analyst can actually act on.
Threat Mapping
Mapping real adversary behavior to frameworks like MITRE ATT&CK to prioritize detections and expose coverage gaps before attackers do.
Network Traffic Analysis
Packet-level investigation and flow analysis — spotting protocol anomalies, beaconing and lateral movement hiding in plain sight.
Red Team–Blue Team Workflows
Adversary emulation that feeds straight back into defense: attack, observe what fired, tune, repeat. Purple teaming in practice.
Security Labs
Hands-on lab environments for attack/defense practice — range building, tooling tests and reproducible scenarios for learning.
// 02 — Focus Areas
Three modes, one loop
Every engagement cycles through the same loop: defend the environment, emulate the adversary, then build the lesson back into the stack.
MODE: DEFEND
Blue Team
Hold the line in live environments — visibility first, then response speed.
- Monitoring & alert triage
- Detection engineering & tuning
- Incident response support
MODE: EMULATE
Red Team
Think and move like the adversary so defenses meet reality, not assumptions.
- Adversary tradecraft & attack paths
- Threat mapping against ATT&CK
- Finding gaps before they're exploited
MODE: BUILD
Cloud & Labs
Where I'm going deeper — securing modern infrastructure and the ranges to practice on.
- Cloud architecture & cloud security
- AWS and Google Cloud
- Lab infrastructure & automation
// 03 — About
About me
I'm Tung Nguyen — a cybersecurity specialist known online as MrMeoMeo. My work sits at the intersection of defense and offense: running security operations, mapping how real adversaries operate, and testing defenses the way an attacker would.
Day to day that means SOC workflows, SIEM-driven detection, threat mapping and network traffic analysis — plus a lot of time in security labs, breaking and fixing things on purpose. My current growth edge is cloud architecture and cloud security across AWS and Google Cloud.
SOC
operations core
RED × BLUE
full-spectrum workflows
ATT&CK
threat mapping
AWS · GCP
cloud security focus
// 04 — Connect
Find me here
Security talk, labs and collaboration — reach me on the channels below.