SM Md Sujon Mia

DHAKA, BANGLADESH · OPEN TO REMOTE

Md Sujon Mia

Thirteen years in business operations, nine of them leading teams. Three outlets opened, 1,200+ people trained in skill development, customer service and leadership, and shifts run that could not stop. Since December 2025 that same work has moved into IT at a 24/7 national news channel.

Email Me LinkedIn Download CV
Years in operations
0
Years leading teams
0
People trained
0+
Staff supported
0+
Endpoints monitored
0+

01 Profile

Operations first,
then security.

Thirteen years in food and beverage operations, nine of them leading. I opened three sites, built training in skill development, customer service and leadership, and trained more than 1,200 people. The last of those jobs was operations manager for a specialty coffee business.

In December 2025 I moved into IT at Channel One, a national news channel with 450+ staff and about 200 on shift at any hour. The job is keeping transmission up: newsroom, production and broadcast-control faults, identity and access for the staff, 30 CCTV cameras and 7 access-control systems, and support for reporters in all 64 districts.

There is no SOC at the channel, so the monitoring side was mine to learn from scratch. I set up Wazuh, watched 100+ Windows and macOS endpoints with it, built dashboards, and worked through patching for vulnerable software and packages.

I'm looking for SOC, security analyst or IT security lead/operations roles, remote or in Dhaka. Email is the fastest way to reach me.

02 Casework

Three incidents, carried end to end.

Detection, containment, eradication, recovery, hardening: the full lifecycle, repeated three times. The two below are the ones worth explaining, because the first is usually misread as a virus alert: credential-attack toolkits that leave no malware signature, found only because someone was watching endpoint telemetry closely enough to notice a built-in account that had no business running processes on a production server.

2026Windows ServerEndpoint alerts

NLBrute & HitlerBrute

RDP brute-force toolkits, running on a production server

Both are credential-attack utilities that guess Remote Desktop logons, which is why no antivirus signature catches them. I found them while working through endpoint alerts. The binaries sat on the desktop of WDAGUtilityAccount, a built-in Defender Application Guard account with no reason to exist on that server, and the processes were still running in Task Manager.

Contained the host, killed the processes, removed the tooling, closed the account path, hardened RDP exposure.

2026EndpointMalware

Neshta.A

File infector with registry persistence

Neshta.A infects executables, persists through the registry and spreads on removable media and network shares. It is the one incident here that behaves like the textbook picture of malware, and it still needed the same discipline: find the scope before cleaning anything, or the reinfection is guaranteed.

Isolated and cleaned the host, verified it clean, tightened the endpoint controls so it didn't come back.

03 Experience

Thirteen years in business operations.
Nine years in leadership roles.

  1. 2025 — Now

    Executive IT (IT & Security Operations)

    Channel One · 24/7 national news channel · Dhaka

    IT and security operations for a channel that never goes off air. I keep newsroom, production and broadcast-control faults moving against deadlines, handle identity and access for 450+ staff, look after 30 CCTV cameras and 7 access-control systems, and support reporters in all 64 districts. I also set up Wazuh to monitor 100+ Windows and macOS endpoints, built dashboards, and worked through patching for vulnerable software and packages.

  2. 2025

    Independent study: security transition

    Self-directed · Dhaka

    Six months between roles spent on security: Blue Team Junior Analyst, TCM Security, the Google Cybersecurity Certificate, and the home lab that the rest of this site leans on.

  3. 2024–25

    Head of Coffee Excellence (Operations Manager)

    Awake Coffee Roasters · Dhaka

    Ran the business end to end. Wrote the SOPs, moved stations until the workflow stopped snagging, ran monthly performance reviews, and set the menu from sales data instead of taste. Trained 300+ people, most of them students or first-time café owners.

  4. 2022–24

    Shift Manager

    Indulge F&B Ltd (United Group) · Dhaka

    Opened three sites: Satarkul and Gulshan-1 from a bare shell, then the Gulshan-2 central branch. Hiring, training and process each time, and the first launch's numbers earned me the second. Monthly sales decks to the CEO and General Manager.

  5. 2021–22

    Career break: skill development

    Self-directed · Dhaka

    TryHackMe Junior Penetration Tester path and Cisco Networking Academy, alongside the first version of the home lab.

  6. 2012–21

    Assistant Manager, Training & Development

    North End Coffee Roasters · Dhaka

    Promoted four times in nine years, from café assistant to Assistant Manager. Leading teams from 2015, and the last four years carried alongside a full-time degree. Built the training curriculum from nothing, trained 150+ staff and 1,200+ external people in skill development, customer service and leadership, and audited branches on quality, service and leadership.

04 Projects

Tools I needed, so I built them.

I design these and AI writes a good share of the code. My Python is basic; the tools still do exactly what I wanted them to do.

windows-power-tool

Python · tkinter · 2026

A portable Windows admin toolbox: one self-elevating EXE, twelve tools, nothing to install. USB storage control, event-log collection to TXT, CSV or native EVTX, system profiling, installed-app inventory, live process and service control. Built on the job because the same manual tasks kept recurring.

Destructive actions confirm first. Locked files are never force-deleted.

security-monitor

Python · Windows Registry · 2025

Blacklist-based software monitoring for Windows and Linux. Reads installed software from the registry uninstall keys and from dpkg/rpm, matches it against a configurable blacklist, grades findings HIGH/MEDIUM/LOW and emails a report on a schedule. Report-only by default, and enforcement is strictly opt-in.

Ships as a portable EXE that installs itself as a SYSTEM scheduled task.

ReconForge

Python · Shodan · VirusTotal · 2025

A cross-platform OSINT toolkit: 44 modules across 64+ platforms and six target types, with a CLI and a GUI that share one scan engine. Passive by default; active modules need an explicit flag and a confirmation. The AI insights can run fully local through Ollama so scan data never leaves the machine.

Writes JSON, Markdown, HTML and text reports.

05 Training and Certificates

Proof, on paper.

Click any one to open it full size. Everything here is issued and dated by the body named underneath it.

Also completed: Ethical Hacking Essentials on Udemy, the WithYouWithMe security tracks behind the home lab, and 107 TryHackMe rooms including SOC Level 1.

06 Contact

Open to Cybersecurity Operations roles.

SOC, Security Analyst or IT Security lead/operations roles. Remote or Dhaka.

sujonmia.0612@gmail.com