Network Support • Security Operations • Detection Engineering

Thomas Scott Ferguson

Security-Focused Network Support Engineer

An enterprise systems and network veteran specializing in infrastructure stability, log analysis, and threat detection pipelines. Seeking dedicated Network Support, NOC, or SOC Analyst roles.

About Me

What I Bring

I translate over a decade of enterprise network and support operations experience into actionable cybersecurity engineering. By combining deep infrastructure troubleshooting with modern security tooling, I build automated detection pipelines and defensive workflows to secure corporate environments.

Network Operations

TCP/IP, DNS, DHCP, NAT, VPNs, firewalls, VLANs, Layer 3 routing, traffic isolation, and enterprise connectivity troubleshooting.

Support Operations

High-priority cases, SLA tracking, Windows/Linux administration, account support, ticket documentation, escalation hygiene, and cross-team coordination.[cite: 1]

Security Operations

Elastic Stack, Kibana/KQL, Wazuh, Sysmon, Windows authentication logs, Linux/OpenSSH logs, Nmap, Wireshark, tcpdump, TShark, Zeek, and RITA.[cite: 1]

Automation

Python, Bash, PowerShell, telemetry extraction, enrichment workflows, structured reporting, and repeatable investigation processes.[cite: 1]

Projects

Featured Projects

SIEM & Threat Intel Automation Pipeline

Python • Elastic/Kibana API • VirusTotal • PostgreSQL • STIX

Pipeline Telemetry Thumbnail

Built an automated Python pipeline that extracts authentication telemetry from Kibana, enriches attacker infrastructure with real-time threat intelligence, and exports ranked indicators for security reporting.

  • Multi-OS Telemetry: Parsed malicious logs across Linux SSH, Windows SSH, and Windows RDP attack data.
  • Intel Enrichment: Automated IP reputation lookups and context tracking via VirusTotal.
  • Risk Scoring: Ranked attacker infrastructure by volume, reputation, service targeting, and repeat activity.
  • Structured Export: Generated STIX-style indicators and markdown reports for GitHub publication.
View Full Project Details →

Cloud ELK/Fleet Telemetry Lab

GCP • Elastic Stack • Fleet • Windows • Ubuntu • SSH/RDP Telemetry

Project Write-up coming soon!

Built a cloud-based security telemetry lab using Linux-hosted Elasticsearch/Kibana and Fleet Server, with hardened Windows and Ubuntu systems intentionally exposed over SSH and RDP to collect real-world authentication attack data.

  • Deployed a four-system GCP lab with separate infrastructure and workload subnets.
  • Collected Linux SSH, Windows OpenSSH, Windows RDP, Sysmon, and Elastic Agent telemetry.
  • Built Kibana dashboards for top source IPs, countries, ASNs, targeted services, usernames, and multi-service attacker behavior.
  • Used enrichment workflows to rank attacker infrastructure and support repeatable reporting.

Cybersecurity Home Lab Architecture

Cisco ASA • Proxmox VE • Active Directory • Wazuh • Sysmon

FergSec cybersecurity home lab topology showing Cisco ASA segmentation, Wazuh Manager, Windows Server domain controller, Windows endpoint, Kali Linux attacker machine, and SOC analyst laptop.

Built a segmented home lab for defensive monitoring, attack simulation, and SOC-style investigation practice.

  • Designed segmented lab networking using Cisco ASA firewalling, NAT, ACLs, managed switching, and VLAN separation.
  • Hosted Windows Server, Windows endpoints, Ubuntu systems, Kali Linux, and Wazuh SIEM components in Proxmox.
  • Collected endpoint and authentication telemetry using Wazuh agents, Sysmon, and Windows/Linux logs.
  • Used the environment for detection engineering, threat emulation, and investigation workflows.

View project write-up

Professional Background

Experience Snapshot

Network Support Engineer — BlueJeans by Verizon

Read more →

Senior IT Analyst / Federal Enterprise Support — EMCO Technologies / ACE-IT Program

Read more →

EPIC Technical Dress Rehearsal Team Lead — Optimum Health IT

Read more →

Desktop Administrator / Assistant Network Administrator — Pro-Vigil

Read more →

Credentials

Certifications & Practical Training

Cyber Defense Analyst Program & CDCP Capstone

Level Effect • Cyber Defense Certified Professional

Completed practical cybersecurity training through the Level Effect Cyber Defense Analyst Program and CDCP capstone, focused on analyst workflow, log triage, packet analysis, threat intelligence, and incident reporting.

  • Investigated endpoint activity using Windows forensic and Sysinternals tooling.
  • Reconstructed network activity from packet captures using Wireshark.
  • Used Linux CLI and Bash scripting to support log triage workflows.
  • Analyzed SIEM data, threat intelligence, vulnerability scan results, and incident evidence.
View CDCP write-up Verify CDCP badge

Security & Cybersecurity

IT, Networking & Systems

  • CompTIA Network+
  • CompTIA A+
  • Microsoft Certified Professional

Contact

Let’s Connect

Available for network support, NOC, SOC analyst, systems support, and security operations roles in the Chattanooga area, remote, hybrid, or Southeast regional opportunities. Full résumé and direct contact information available through LinkedIn, formal applications, or recruiter request.

LinkedIn Profile