Cybersecurity Analyst Candidate Cape Girardeau, MO · Open to relocation

CompTIA Security+ · AI & Detection

Wilson
Katsande

I am a Cybersecurity major who builds with AI as well as defends against it. I trained a phishing detector on more than 80,000 emails, my Azure honeypot logged over 10,000 brute force attempts in 24 hours, and I placed 2nd in the Zscaler Capture the Flag beta. CompTIA Security+ certified, 3.9+ GPA at Southeast Missouri State University.

Scroll ↓
Graduating Dec 2027
Drag to orbit the terminal
{{ f.label }}
{{ f.value }}
{{ f.note }}

Where AI meets
security work

I am a Cybersecurity major with a strong interest in artificial intelligence, and I look for creative ways to bring the two together. That interest shows up in what I build. The phishing email detector on this page was trained on a dataset of more than 80,000 emails, and I rebuilt a web scraping agent around a locally hosted Llama 3.2 model to understand how these systems work from the inside.

My view of security is that you have to stay a step ahead of your adversaries, which means thinking about how someone might attack you before they try. AI is changing that landscape quickly, and it works in both directions. Attackers are already using it, so defenders need to understand it just as well.

That is why I spend time on both sides of it: attacking models in a vendor cyber range, training my own, and teaching other people how to use AI tools without putting company data at risk.

{{ a.tag }}
{{ a.title }}
{{ a.note }}

The numbers

With a short note on where each one comes from

{{ row.code }}
{{ row.value }}
{{ row.label }}
{{ row.note }}

Where I have worked

Enterprise IT and university IT support

June 2026 to July 2026 · OneHope USA

Information Technology Intern

OneHope is a global nonprofit with staff and partners in more than 100 countries, so its data is spread across many regions and regulations. I spent the internship on the governance side of that problem: deciding how sensitive data should be labeled, monitored, and retained inside Microsoft 365.

› Researched data governance frameworks and mapped them to Microsoft Purview for classification and data loss prevention, and Microsoft Sentinel for centralized log collection and alerting. I wrote a formal report and presented the findings and recommendations directly to IT leadership.
› Built and delivered the AI literacy session shown here to more than 20 interns, covering what is safe to paste into a public model, how to spot fabricated output, and which approved tools to use for work data.
› Contributed to the organization's AI Center of Excellence meetings, where department leads align on which AI tools get approved and how adoption is governed.
AI training session slide titled OBM Sprint AI training, presented by the IT Department at OneHope
The AI literacy training I built and delivered to OneHope interns and staff.
Wilson Katsande working at a console in the university networking lab
Console work in the SEMO networking lab, where I also support students and staff.
September 2025 to present · Southeast Missouri State University

IT HelpDesk Technician

Front line support for students, faculty, and staff. A lot of good security habits come from this job: verifying who is asking before you help them, documenting what you changed, and following policy even when a shortcut would be faster.

› Diagnose hardware and software faults at the walk up desk while enforcing university IT and data security policy, including account verification before any access change.
› Document each issue and how it was resolved, so the next assistant handles a repeat problem the same way. It is the same discipline a security operations ticket queue runs on.
› Maintain asset inventory in Excel and internal software so every piece of lab hardware stays accounted for. You cannot defend equipment you do not know you have.

Competitive security work

Vendor run cyber ranges, scored against other participants

{{ c.alt }}
{{ c.result }} {{ c.when }}

{{ c.title }}

What it is

{{ c.what }}

What I did

{{ c.did }}

Things I built

Home lab and university lab, all hands on keyboard

Azure home lab · Threat detection

Honeypot deployment and attack analysis

A honeypot is a deliberately exposed machine that has no legitimate users, so every login attempt against it is hostile by definition. I stood one up on Azure, opened it to the internet, and configured firewall rules and logging so I could study who came knocking.

Within 24 hours it recorded more than 10,000 failed brute force login attempts. I forwarded the security event logs into a workbook, geolocated the source addresses, and built the map shown here so the traffic could be read at a glance instead of line by line.

What surprised me most was the concentration. A handful of very persistent sources accounted for the bulk of the traffic, with the top one alone responsible for 12.1 thousand attempts, and the busiest cluster sat in the United States rather than overseas.

World map of honeypot attack sources with counts by city, largest cluster 12.1 thousand attempts
Attack sources geolocated from my honeypot logs. Top source alone accounted for 12.1 thousand attempts.
Cisco router and switch rack wired with orange cables, PuTTY console showing router interface configuration
Physical Cisco pod with a console session bringing up GigabitEthernet interfaces on three subnets.
University lab · Physical hardware

Cisco networking builds on real gear

This work is done on physical Cisco routers and switches rather than in a simulator. I cable the pods, configure them over a serial console, assign addressing across separate subnets, bring the interfaces up, and confirm the result with show commands.

Covered so far: DHCP, TCP/IP addressing, static routing, subnetting, VLAN switching, and console recovery on a device I managed to lock myself out of. Once you know how traffic is supposed to move through a network, odd entries in a log stand out much faster.

Python · Data protection

PDF redaction app for sensitive data

Documents get shared far more often than anyone reviews them line by line, and a single invoice or intake form can carry a social security number or a full card number. I built an application that reads a PDF, finds sensitive information inside it, and redacts it before the file goes anywhere.

It looks for personally identifiable information such as names, addresses, phone numbers, email addresses, and social security numbers, along with payment data like credit card numbers. Structured values are matched by pattern and validated, while names and addresses need context, since a nine digit number is only a social security number depending on where it sits in the document.

One detail I made sure to get right is that the redaction removes the underlying text rather than drawing a black box over it. Plenty of published documents have leaked because someone covered the text visually and left it selectable underneath. This project came out of the data governance work I did at OneHope, where classifying sensitive data is the first step before you can protect it.

What it detects and redacts
{{ r.type }} {{ r.method }}
{{ r.note }}
Python · Machine learning

Phishing email detector trained on 80,000 emails

Phishing is still one of the most common ways an attacker gets in, and no team has time to read every suspicious message by hand. I trained a supervised machine learning classifier on a labeled set of roughly 80,000 legitimate and phishing emails so the obvious cases get sorted automatically.

The pipeline cleans and tokenizes each message, converts the text into numerical features, then scores it as phishing or legitimate. The lesson I took from it was about false positives. If a filter quarantines real business mail, people stop trusting it and turn it off, so I tuned the model toward precision instead of chasing the highest overall accuracy.

It pairs well with the honeypot project. The honeypot showed me how automated attacks behave at the network level, and this one gave me a look at how they arrive in someone's inbox.

How the pipeline runs
{{ step.n }} {{ step.title }} {{ step.body }}
Python · Local LLM

Reverse engineering a web scraping AI agent

I took apart a web scraping AI application to understand how it worked, then rebuilt and ran it myself. It takes a URL and a plain English instruction, fetches the page, and uses Llama 3.2 running locally to pull out only the information you asked for. Because the model runs on my own machine, none of the scraped content leaves it.

I learned far more from this than I expected, and honestly I was surprised how straightforward an AI powered scraper is to put together. It also showed me a real risk from the defensive side, since an agent that reads untrusted web pages can be fed instructions by those pages. That is the same prompt injection problem I worked on in the Cisco AI Defense range. I am using what I learned here as the starting point for a larger project.

Web scraping AI agent interface with URL field and instruction field, powered by Llama 3.2
The rebuilt agent running on my own machine against a local Llama 3.2 model.

Education
and credentials

Bachelor of Science in Cybersecurity at Southeast Missouri State University in Cape Girardeau, MO. GPA 3.9 or higher, degree conferred December 2027. Each credential below is verifiable and dated.

Cisco Networking Academy verified badge for CCNA Introduction to Networks
Verified Cisco Networking Academy badge.
{{ item.year }} {{ item.status }}
{{ item.title }}
{{ item.detail }}

Skills, and where I used them

Every tool here is one I have used hands on

{{ s.group }}
{{ s.items }}
{{ s.where }}

What I am working toward

{{ goal.when }}
{{ goal.title }}

{{ goal.body }}