Final-year cybersecurity student · Penn State

Travis Ma

Vulnerability Management Security Operations Cloud Security

I’m a final-year Penn State cybersecurity student who started in IT support before moving into security operations and vulnerability management. Through professional experience and hands-on projects, I’m working to bridge the gap between security engineering and operations.

Follow my journey GitHub LinkedIn
20M+
findings I helped evaluate during my VM internship
150K+
devices supported by workflows I helped improve
100+
customers I supported through hands-on IT work
10+
security builds and investigations I documented
4
industry certifications I earned
May ’27
when I expect to graduate from Penn State

01 / My journey

Each step moved me closer to the security work I wanted to do.

I began by repairing computers and helping people solve everyday technology problems. That experience taught me to investigate carefully and communicate clearly. Those skills became the foundation for my work in security operations and vulnerability management.

Oct 2023 — May 2025

Computer Technician

Freelance · King of Prussia, Pennsylvania

Foundation

This is where I learned that technical skill matters most when I can turn it into a clear solution for another person.

  • I independently ran a computer support service for 100+ customers, handling custom builds, diagnostics, malware removal, and performance optimization.
  • I taught customers across age groups how to use and maintain their devices safely, helping them avoid recurring problems.
Dec 2025 — Apr 2026

Cybersecurity Analyst Intern

LOG(N) Pacific · Remote

Security operations

My first security role moved me from troubleshooting individual systems to investigating activity across cloud and enterprise environments.

  • I used Microsoft Defender for Endpoint and KQL to conduct threat hunts, investigate incidents, and isolate high-risk endpoints.
  • I triaged Microsoft Sentinel alerts by analyzing supporting telemetry, documenting what I found, and escalating actionable threats.
  • I developed Sentinel analytics rules and dashboards and automated Tenable remediation with PowerShell and Bash to improve visibility and reduce exposure.
May 2026 — August 2026

Security Engineer Intern

GoDaddy · Tempe, Arizona

Engineering at scale

At enterprise scale, I learned how engineering, analysis, and communication come together inside a vulnerability-management program.

  • I built a vulnerability-chaining framework that analyzed 20M+ findings across 50K+ devices and surfaced risky CVE combinations that individual severity scores could miss.
  • I evaluated 400+ false-positive requests by researching Qualys behavior and root cause, contributing to 97% vulnerability-management SLA compliance.
  • I improved a Qualys VMDR-to-ServiceNow pipeline supporting 2.5M+ findings across 150K+ devices and worked directly with system owners to move remediation forward.

02 / Projects I’m proud of

What I built to turn ideas into working security solutions.

These six projects show how I apply what I learn. Each one started with a question or challenge, then pushed me to research, build, investigate, and document a practical result.

01 / 06

Use Previous and Next, arrow keys, or swipe the card

Detection & responseCompleted lab

Automated Threat Detection & Incident Response

I built an Active Directory lab that connects Splunk SIEM, Shuffle SOAR, and Slack into an end-to-end workflow for detection, analyst alerting, and automated containment.

  • I reduced lab MTTD from 10+ minutes to under one minute
  • I reduced simulated MTTR by 90% through automated containment
View what I built
Why I built it

I wanted to understand how separate detection, communication, and response systems could work together as one repeatable workflow.

What I did

I wrote detections for malicious hashes, phishing infrastructure, ransomware, C2, stolen tokens, OAuth abuse, and persistence, then connected Splunk webhooks to Shuffle SOAR and Slack.

What it achieved

I reduced lab MTTD below one minute and simulated MTTR by 90%, using playbooks to quarantine files, isolate hosts, purge emails, revoke sessions, remove OAuth access, and disable accounts.

Active DirectorySplunkShuffleSlackSOAR
Cloud securityComplete

Cloud Security Posture Automation

I created an Azure security-control framework that assesses configurations, maps findings to standards, and remediates security drift automatically.

  • I automated 5+ Azure security controls
  • I reduced a compliance scan from about one hour to under five minutes
View what I built
Why I built it

I wanted to see how cloud-security reviews could move from occasional manual checks to continuous, repeatable control validation.

What I did

I combined Python scans, hourly Azure Automation runbooks, and Terraform remediation mapped to CIS and NIST CSF.

What it achieved

I produced a self-healing workflow with automated reporting that checks for drift and restores approved configurations.

AzurePythonTerraformPowerShellCISNIST CSF
Security operationsCompleted reports

Threat Hunting Reports

I documented evidence-led investigations that reconstruct suspicious activity, identify detection gaps, and map attacker behavior to MITRE ATT&CK.

  • I documented queries, screenshots, evidence, and investigation timelines
  • I completed a full unauthorized Tor usage investigation
View my investigations
Why I built it

I wanted to practice going beyond an alert to explain the full sequence, context, and control gaps behind suspicious behavior.

What I did

I queried Defender telemetry with KQL, correlated file, process, and network events, and built defensible timelines from the evidence.

What it achieved

I produced repeatable hunt reports that explain what happened, how I found it, and which detections or controls should improve next.

Defender for EndpointKQLMITRE ATT&CKAzure
Vulnerability managementDeployed

VM Analysis Tool

I built a web-based triage workspace that combines CVE, CVSS, EPSS, and CISA KEV intelligence into one operator view for faster remediation decisions.

  • I integrated three authoritative vulnerability sources
  • I turned technical enrichment into readable assessment guidance
Try my application View source
Why I built it

I saw how fragmented vulnerability context could slow triage, so I wanted to make the most useful signals easier to compare.

What I did

I normalized NVD, FIRST EPSS, and CISA KEV data into a modular one-page assessment built with Next.js and TypeScript.

What it achieved

I created a single view where analysts can compare severity, exploitation probability, and known real-world exploitation without switching tools.

Next.jsTypeScriptNVDEPSSCISA KEV
Malware analysisCompleted proof of concept

Malware Analyzer + EDR

I created a static Windows executable analysis tool that combines PE inspection, IOCs, YARA, reputation data, and EDR containment.

  • I consolidated multiple signals into one JSON risk report
  • I demonstrated policy-based endpoint isolation through LimaCharlie
View what I built
Why I built it

I wanted to understand how multiple static-analysis signals could be evaluated together instead of reviewed in isolation.

What I did

I extracted PE metadata, suspicious APIs, strings, hashes, YARA matches, and VirusTotal results into a scoring engine.

What it achieved

I built an educational proof of concept showing how enrichment can inform—but should not solely determine—containment.

PythonYARAVirusTotalPELimaCharlie
Cloud & DevSecOpsDeployed

AWS Cloud Portfolio

I built this website’s production platform as a serverless AWS architecture managed through infrastructure as code and automated delivery.

  • I used short-lived GitHub OIDC credentials instead of access keys
  • I connected automated tests, backend deployment, and frontend synchronization
View the architecture
Why I built it

I wanted my portfolio to demonstrate my cloud-engineering skills rather than only describe them.

What I did

I provisioned S3, CloudFront, Route 53, ACM, API Gateway, Lambda, and DynamoDB with SAM and CloudFormation.

What it achieved

I deployed a secure, serverless portfolio with HTTPS, a visitor API, tests, CI/CD, and reproducible infrastructure.

AWSSAMCloudFormationPythonGitHub ActionsOIDC

03 / What I bring

What I bring to a security team.

I’m most effective where engineering and operations meet. I build tools and automation to solve security problems, investigate alerts, vulnerabilities, and technical evidence, and communicate findings clearly to the people responsible for acting on them.

01 / I build

I turn security problems into working solutions.

I use programming, automation, and cloud infrastructure to remove manual work and make security controls more consistent and repeatable.

  • Programming & automationI work with Python, PowerShell, Bash, and APIs.
  • Applied AI & LLMsI use AI and LLM workflows to accelerate security analysis, structure technical evidence, and support automation.
  • Cloud & infrastructureI build with AWS, Azure, serverless services, Terraform, CloudFormation, and CI/CD.
  • Security controlsI create detection logic, SOAR playbooks, policy guardrails, and automated remediation.
02 / I investigate

I follow the evidence to the root cause.

I analyze alerts, vulnerability findings, and system behavior so I can separate signal from noise and support defensible response decisions.

  • Vulnerability managementI validate false positives, add threat context, prioritize exposure, and follow remediation through.
  • Detection & responseI triage SIEM and EDR alerts, investigate incidents, determine root cause, and support containment.
  • Threat huntingI use KQL, SPL, hypotheses, and MITRE ATT&CK to investigate behavior and improve detections.
  • Cloud security analysisI assess cloud configurations, identity controls, and security telemetry to identify exposure and control gaps.

04 / Where I am now

I’m finishing my degree and preparing for what comes next.

I’m in my final year at Penn State, completing a B.S. in Cybersecurity Analytics and Operations. My current focus is deepening my skills in security operations, vulnerability management, and cloud security while continuing to build with automation and analytics.

05 / How I built this portfolio

I wanted this site to prove the skills behind it.

I chose a serverless AWS architecture so I could practice the same cloud-engineering decisions I describe elsewhere: infrastructure as code, least-privilege deployment, automated testing, and repeatable delivery.

DNSRoute 53
→
Edge + TLSCloudFront
→
FrontendAmazon S3
→
APIAPI Gateway
→
Compute + dataLambda / DynamoDB

— visits recorded by the serverless counter I built · I deploy through GitHub Actions with AWS OIDC

Want to talk?

Let’s connect.

If you’d like to discuss an opportunity, a project, or anything related to security operations, vulnerability management, or cloud security, I’d be happy to talk.

Connect on LinkedIn