Building My GitHub Cybersecurity Portfolio (What I'm Including and Why)
- Aug 7
- 6 min read
A transparent look at structuring a security portfolio when you're coming from a data background — what to include, and what each project actually says to the person doing the hiring.
Eighteen months ago, when I started moving into cybersecurity, I had a decade of analytics experience, a graduate degree, a GitHub with some old hackathon repos — and exactly zero things on it that said the word "cybersecurity."
That's the trap nobody warns career-changers about. It isn't a skills gap — it's a labeling gap. You've done the work. You've found the anomalies, validated the data, chased the outlier that didn't belong. But a recruiter scanning your profile for thirty seconds can't see any of that unless it's packaged in a way they recognize.
So I built a portfolio. Not a pile of repos — a deliberate, aimed one. Here's what's in it, why each piece is there, and a free board to help you build your own.
The board: what to build
I made a GitHub Portfolio Bingo board — a one-page map of what a recruiter-ready security portfolio actually contains. It's free, it's printable, and it's the board I'm working through myself. (I haven't checked every square yet — that's the point. It's a path, not a trophy.)
It's organized into three kinds of squares:
Action steps — write a professional summary, pick your lane, structure a write-up, link your projects from LinkedIn.
Real-project squares — the pieces that turn a profile from "took some courses" into "does the work": publish an investigation repo, ship a detection project, write it up.
An "avoid" row — the mistakes that quietly sink a portfolio: certs as the whole thing, empty repos with no docs, copied tutorials with no original input.
Full disclosure on my own board: five of those squares are already my receipts — my Mirai investigation repo, my anomaly detection pipeline, a TryHackMe writeup, a blog post with a project link, and an MITRE ATT&CK mapping. The rest I'm still working through. That's the honest state of it — a path, not a finished trophy.
The free space in the middle says it all: DONE > PERFECT. Ship it.
Grab the board, print it, cross things off. A board tells you what to build — it doesn't tell you how each piece reads to the person doing the hiring. That's where the real work is, and it's what the rest of this post is about.
The proof: two projects, walked through
A portfolio isn't a checklist of repos. It's evidence. Here are the two projects doing the heaviest lifting on mine — and, more importantly, what each one is meant to demonstrate to someone deciding whether to interview me.
1. The Mirai Investigation — hunting by hand
repo
I took a single raw Zeek connection log — 1.3 million records — loaded it into SQLite, and used nothing but SQL to reconstruct a complete network breach. No SIEM. No pre-built alerts. No guided lab holding my hand.
What the data confessed, one query at a time: an internal host responsible for 513,865 failed connections. The Mirai signature, confirmed through port analysis. Three infected machines across two subnets. C2 beaconing on a fixed rhythm. And — the finding that changed the whole severity of it — evidence of an attacker who was already inside the network, holding multi-hour SSH sessions.
What it demonstrates: that I can hunt. That I can start from "something here looks wrong," follow the anomalies, name the threat, and document it in a way a SOC team could act on. The queries are public and reproducible — anyone can rerun the hunt.
2. The Anomaly Detection Pipeline — automating the hunt
repo
The Mirai hunt was manual. This project asks: can I teach a model to do the flagging for me?
Using SQL to preprocess the CIC-IDS-2017 dataset and an IsolationForest model in Python, I built a pipeline that surfaces suspicious network flows — and, crucially, explains why each one got flagged. Tuning the model moved precision from 34.8% to 48.4%, and the most interesting finding wasn't a number at all: the genuinely malicious flows didn't live at the far extreme of "most anomalous." They sat a notch in, in the moderate zone. The obvious outliers were mostly noise.
What it demonstrates: that I can automate detection and — the part that matters more — that I know exactly how far to trust the result. I documented the dataset's known label-quality problems and reasoned about what they mean for my numbers, rather than just reporting an accuracy figure and moving on.
The one-two that ties it together
Manual hunting. Automated detection. Read together, those two repos say: this is someone who can find the thing that doesn't belong by hand, and then build the system that finds it at scale. That's the story I want a hiring manager to walk away with — and it's a story two aimed projects tell far better than ten scattered ones.
Pick your lane (and know when a role isn't yours)
Here's the discipline most portfolio advice skips: a portfolio should be aimed.
Let me show you what I mean with a real job posting. I recently came across a GRC Cybersecurity Analyst role — governance, risk, and compliance. Internal audits. SOC 2, ISO 27001, HIPAA. Tabletop exercises. Risk assessments. Technical writing over technical doing. The posting even said, plainly, that it was not a SOC analyst role — no log monitoring, no alert response, no vulnerability scanning.
It's a genuinely good role. Well-described, legitimate, valuable work. And it is completely, cleanly not my lane.
I target detection — SOC and cyber analyst work. So I didn't apply. Applying anyway would have wasted the hiring team's time and mine, and my portfolio — built around threat hunting and anomaly detection — would have looked like a mismatch on arrival.
That's the muscle worth building: reading a posting closely enough to know whether it's actually yours. Career-changers see the word "cybersecurity" and apply to everything, which is exactly the flood employers complain about. The sharper move is to read the tells — the frameworks, the responsibilities, even the location and work arrangement — and aim.
Same person, different lane, different portfolio. If I were chasing GRC, I'd be showcasing compliance mappings and audit evidence, not a Mirai hunt. Because I'm chasing detection, my two repos are exactly the right two. A focused portfolio reads as intentional. A scattered one reads as lost.
Your old work is already security work
One last reframe, because it took me too long to see it myself: if you come from data, analytics, or any technical-adjacent field, you are not starting from zero.
A dashboard you built is a security metrics visualization. An anomaly-detection script is flagging suspicious flows. The years you spent translating analysis for stakeholders who didn't do the analysis? That's the exact communication skill a SOC team needs, and most junior candidates lack. The subject changes. The instinct doesn't.
I spent a decade finding the one data point that didn't fit — first in atmospheric data, then across healthcare, compliance, and risk. Now I find the one flow on a network that doesn't belong. The tools are new. The hunt is the same.
Start with the board
If you have the skills but not the "cyber-labeled" projects yet, start with the board. Print it. Pick your lane. Build one real thing and write it up well. Ship it before it's perfect.
Two ways to use it:
Print it — the static board is made for a wall or a notebook. Cross squares off by hand.
Grab the printable board ↓
Play it online — the interactive board lets you check off squares and track your progress right in the browser.
Open the interactive board. ↓
I'm also putting together a deeper companion guidebook — a section-by-section walkthrough of how each portfolio piece reads to a hiring manager, with my own repos as the worked examples. More on that soon.
For now: the board tells you what to build. Go build one thing. The person who gets hired shipped an imperfect portfolio and improved it. The person who didn't is still polishing.
The tool changes. The question doesn't. 💜
Comments