SOC Analysis · Cohort 1 finalist
Mercy David
Built DEVL: Evidence-Backed Security Decision Verification.
SOC Analysis project
DEVL: Evidence-Backed Security Decision Verification.
The problem: Security analysts make important decisions about cyber incidents every day, such as whether an alert is harmless or a real attack. But it is difficult to verify whether their decision was actually supported by the available evidence. An explanation can sound convincing while missing important evidence or relying on incorrect information. This becomes an even bigger concern when AI is used to help generate security explanations. Who benefits: Security teams that need to make faster and more trustworthy incident decisions, as well as compliance and audit teams that need clear evidence showing why a decision was made. What we built: DEVL is a decision verification layer for security investigations. It takes an analyst’s decision and reasoning and checks them against the actual security evidence. It identifies what the evidence supports, what it contradicts, what is missing, and what important evidence the analyst may have overlooked. DEVL also checks whether evidence is actually related to the incident being investigated, helping prevent unrelated activity from being treated as part of an attack. Each verified decision is cryptographically sealed so the record can be ch
In their words.
I joined Ubuntu Bridge Initiative's Cohort 1 wanting to find out if I could actually do the work of a SOC analyst, and not just talk about it.
The Sankofa Digital investigation was where that got tested. I had to triage alerts, correlate logs across a SIEM, and map everything back to MITRE ATT&CK, then write it up as a proper incident report, the kind a stakeholder could actually read and act on.
By Stage 2 I was in web application security, working through SQL injection, XSS, SSRF, JWT issues, XXE, and scoring each finding with CVSS 3.1 in a full pentest report.
Stage 3 pushed even further, building STIX 2.1 IOC bundles and forensic reports straight from evidence , the same standard used in real threat intel work.
What stood out to me is that UBI didn't simplify the work to make beginner-friendly, they gave us the real complexity of the job and trusted us to rise to it.
That is what built my confidence to actually call myself a SOC analyst.
If you are considering applying to UBI, please come prepared and determined as you wont just learn concepts, but you will be able to prove you can do the job.
