ALERT-01HIGH
Suspicious authentication
Choose the strongest first investigative action before containment.
Alen Krga.
Senior IT Security & Resilience Engineer.
My expertise lies where security engineering meets risk and resilience: how attacks really unfold, which risks deserve attention, and how systems recover when something breaks.
I came to security through software development and operations, so I like turning knowledge into tools people can use. I build free security apps and write about what I learn.
Based in Croatia, previously Dublin.
Where my knowledge lies.
- Threat-informed risk
- Thinking like an attacker with MITRE ATT&CK and threat modelling: realistic attack paths, control gaps and the mitigations that actually reduce risk.
- Detection and investigation
- How good detections are designed and tuned, and how to reconstruct what happened from logs and evidence: timeline, scope and root cause.
- Vulnerability and exposure
- Risk-based prioritisation that weighs severity against exploitability, known exploitation, exposure and business impact.
- Digital operational resilience
- Disaster recovery and continuity thinking: critical dependencies, recovery scenarios, tabletop exercises and readiness improvements.
- Governance and controls
- NIST SP 800-53, second-line risk, policy exceptions and audit evidence: turning findings into owned, time-bound decisions.
- Security engineering and automation
- Python, C#, JavaScript, SQL and REST APIs, plus AI-assisted tooling built with prompt injection and data leakage in mind.
From running a business to security and resilience.
I started out running my own retail and e-commerce business. In Dublin I moved into operations, auditing and policy work, then cyber risk. My path continued into security and resilience engineering in Croatia. That mix is why I look at security through evidence and business context, not technical severity alone.
Current role
Senior IT Security & Resilience Engineer
IT Security Operations
Cyber & Information Security Analyst, second line
Policy SME, Auditor & Operations Analyst, Trust & Safety
Business owner, retail & e-commerce
Security apps I build in my spare time.
Small, practical tools that turn security data into clearer decisions. Free to use, no account needed.
- CyberScrollStay ahead.
- ReconDeckFree Security Toolkit
20 free security tools in the browser: IP exposure, DNS and email security, SSL certificates, CVE intelligence and password breach checks.
- CybersecAsk Before You Click
Check any link, domain or email against public phishing, malware and scam lists and four independent DNS security filters. Plus password and quick tools. No account or API keys.
- VulnSignalVulnerability Intelligence
Bring CVE context, exploit likelihood and known exploitation data together to support risk-based vulnerability prioritization.
- MailTraceEmail Header Analyzer
Inspect email routing, authentication and header data in a clearer workflow for email security analysis.
The lab
Four short scenarios like the one at the top, an analyst terminal to explore this page, and something hidden for anyone who finishes all four.
Analyst terminal
Type help to see commands, or mission to start a scenario.
alen / analyst terminal
LOCAL SESSION · --:--:--
All missions complete. An unexpected signal has appeared.Try
sudo restore signal in the terminal.analyst@portfolio:~$
Four decisions
Evidence, judgement and trade-offs. Finish all four to unlock the hidden signal.
XP 000
VULN-01MED
Vulnerability priority
Balance technical severity with exposure and business context.
ATK-01HUNT
Threat-informed investigation
Use behavior and telemetry to validate a threat hypothesis.
RISK-01RISK
Control exception
Choose a risk treatment that is explicit, owned and time-bound.
Certifications
CompTIA CSAP2025
CompTIA CySA+2025
CompTIA Security+2024
CompTIA Network+2024
Also: MITRE ATT&CK and NIST SP 800-53 training, and full-stack software development (Python, JavaScript, SQL, C#). PenTest+ in progress. English and Croatian.
Verify on Credly ↗Writing about cybersecurity.
Recent posts from my blog.
- What is CyScan.io
CyScan.io, also known as Cyber URL Scanner, is a simple online tool to check websites before you interact with them.
- Asymmetric encryption
How public and private key pairs protect data, and why encryption plays a key role in keeping it safe.
- What is symmetric encryption?
A method of protecting data with one private key to encrypt and decrypt it, shared by sender and recipient.