Bisrat Kura | Portfolio

Hello World,

I am a Threat Intelligence Analyst fascinated by IT and its security issues. With a strong passion for technology, I like to take on problems to respond to current challenges in cybersecurity.

<ABOUT/>

Bisrat Kura is a cybersecurity professional specializing in threat intelligence. He holds a Bachelor's degree in Computer Science from Beijing Institute of Technology and a Master's in Cybersecurity and Threat Intelligence from the University of Guelph. Currently a Threat Analyst at eSentire. With experience collecting and correlating data from the Dark Web, OSINT platforms, and malware repositories, Bisrat identifies emerging threats and provides timely insights to stakeholders. He is also highly experienced in developing and automating threat intelligence workflows, enabling faster decision-making and improved threat visibility. In addition to operational work, Bisrat is actively involved in cybersecurity research and the development of innovative detection and mitigation solutions. His research focuses on enhancing threat detection capabilities and uncovering novel attack patterns, often contributing to threat actor profiling and TTP analysis. Outside of work, Bisrat enjoys road trips, photography, traveling, and jazz music.

Request CV

Interests

Threat Intelligence
Detection Engineering
Agentic-AI
Open Source Intelligence

Education

Master's degree, Cybersecurity and Threat IntelligenceUniversity of GuelphSep 2024 - Sep 2025

Bachelor of Science, Computer ScienceBeijing Institute of TechnologySep 2017 - Jun 2021

Cyber Threat Intelligence (CTI)

Specialized in Cyber Threat Intelligence (CTI), with experience in collecting, analyzing, and interpreting threat data from various sources. Proficient in identifying Indicators of Compromise (IoCs), tracking Advanced Persistent Threats (APTs), and producing actionable intelligence to mitigate cyber risks.

Open Source Intelligence (OSINT)

Expert in leveraging Open Source Intelligence (OSINT) methodologies to uncover actionable insights from public sources, including the clearnet, dark web, and social media. Skilled in using OSINT tools and techniques to identify potential threats, vulnerabilities, and malicious actors.

Detection Engineering

Highly experienced in developing, tuning, and maintaining detection rules across platforms such as Carbon Black, Sumo Logic, and Suricata to ensure content parity and visibility across diverse security stacks.

Secure Software Development

Experienced in designing and developing large-scale security tools and automating intelligence-gathering processes. Skilled in secure coding practices, building custom threat detection systems, and integrating cybersecurity solutions across various platforms.

<PROJECTS />

1 Year | Group Project

Threat Intelligence Platform

Developed the backend of a sophisticated threat intelligence platform. The dashboard offers unprecedented visibility and analytical capabilities, enabling clients real-time identification of compromised data from various sources.

Created on: 01/05/2023

1 Year | Solo

Stolen Credentials Parsers Project

Developed various parsers for parsing specific types of stolen credential files published by threat actors. It is designed with regex-driven extraction to normalize domains, IPs, emails, and credentials from adversary data dumps facilitating efficient and secure storage.

Created on: 20/04/2023

3 Weeks | Solo

Downloader Data Toolkit

Built a toolkit where I developed an automatic intelligence data downloader, extractor, and ingestion module from threat actor managed Telegram channels. The toolkit supports both scheduled extractions and real-time monitoring feeding data into an ingestion service that automatically extracts, and stores the data.

Created on: 01/08/2023

1 Year | Solo

InfoStealer Log Parsers

This project is a comprehensive system for parsing various info stealer malware log formats. It analyzes logs of stealer malwares and extract intellegince data from them and sending intelligence data to designated endpoints for utilization in a CTI platform.

Created on: 01/09/2023

3 Weeks | Solo

Secure File Transfer Project

Client-Server application, written in C++, that resembles a Cloud Storage. In this project all the security protocols (for authentication and data transmission) have been designed specifically for this project and have been implemented using OpenSSL. Each user has a “dedicated storage” on the server, and User A cannot access User B dedicated storage. Users can Upload, Download, Rename, or Delete data to/from the Cloud Storage in a safe manner.

Created on: 01/04/2022

2 Months | Solo

Tiny Encryption and Decryption Algorithm Project

Implemented the Tiny Encryption Algorithm (TEA), both encryption and decryption modules performing logic design, circuit design, and physical design processes using Hardware Description Language (HDL), and tested the performance.

Created on: 01/03/2022

2 Weeks | Solo

Trojan Horse Project

Developed a Trojan horse malware that is capable of taking a screenshot of users' keystrokes and sends the screenshots to remote storage.

Created on: 01/11/2021

3 Weeks | Solo

Watchdog Project

Watchdog project is a Python program designed to monitor any command and restart it if necessary. It provides a simple and flexible solution for ensuring the continuous execution of critical commands or processes.

Created on: 05/07/2023

5 Months | Solo

Forum Scraper

This project is a custom-built tool designed to scrape and analyze online forums, focusing on extracting valuable threat intelligence from both open and dark web sources. The tool automates the process of gathering posts, comments, and metadata related to cybersecurity threats.

Created on: 11/06/2023

1 Weeek | Solo

Advanced Persistent Threat (APT) Malware Detection

Extracted opcodes of malwares from different APT groups and analyzed using GHIDRA and IDA Pro, Pre-processed malware OpCodes. Implemented feature engineering using n-gram counts and PCA; applied SVM, KNN (k=3.5), Decision Tree, and Random Forest models. Achieved high accuracy and F1 scores; evaluated models using key metrics

Created on: 01/11/2024

<EXPERIENCES />

eSentire

Oct 2025 - Apr 2026Waterloo, Canada

Threat Analyst

Permanent Full-Time

Operationalized complex threat research into high-fidelity security outcomes by developing and tuning detection rules for Carbon Black, Sumo Logic CSE, and Suricata achieving content parity across other supported products insuring consistent detection coverage of adversary TTPs for thousands of enterprise clients.
Managed the TRU threat content repository on GitHub and conducted technical peer reviews to ensure the quality and accuracy of production detection content.
Engineered Agentic AI-powered workflows to build and maintain robust detection-as-code pipelines, significantly automating threat data parsing and API integrations.
Analyzed large security datasets and applied MITRE ATT&CK framework mappings to identify attacker TTPs and create actionable, high-fidelity alerts.

eSentire

Apr 2025 - Sep 2025Waterloo, Canada

Threat Intelligence Analyst

Internship

Worked on projects related to Adaptive ML-Driven Detection of Scheduled Task Anomalies and Automated Threat Attribution.
Developed an unsupervised learning pipeline to identify AiTM phishing infrastructure reuse. My research titled Adversary-Centric Approach to Clustering AiTM Toolkits got selected as an Alternate Presentation (ALT-1158) for the RSAC 2026 Conference.
Investigated various cybersecurity incidents, extracted IOCs, and validated true positives across Sumo Logic, CrowdStrike Falcon, and Microsoft Defender.

University of Guelph

Sep 2024 - Sep 2025Guelph, Canada

Student

Full-time

CIS*6510 - Cybersecurity and Defense in Depth
CIS*6520 - Advanced Digital Forensics and Incident Response
CIS*6530 - Cyber Threat Intelligence and Adversarial Risk Analysis
CIS*6540 - Advanced Penetration Testing and Exploit Development
CIS*6550 - Privacy, Compliance, and Human Aspects of Cybersecurity
CIS*6580 - Security Monitoring and Cyber Threat Hunting
CIS*6590 - Professional Seminar in Cybersecurity
CIS*6560 - Cybersecurity Project

Defenda Solutions

2022 - 2024Lucca, Italy · On-site

Cybersecurity Analyst

Full-time

Automated, real-time collection of raw intelligence from diverse dark web forums, closed sources, and adversary communication channels to collect IOCs.
Tracked and profiled threat actors by engineering high-performance parsers that extracted and normalized and ingested indicators (domains, IPs, emails) from complex adversary data dumps.
Designed a comprehensive framework to parse and analyze malware logs from high-risk info-stealer families (RedLine, Raccoon, LummaC2, etc.), converting unstructured data into actionable intelligence.
Developed end-to-end automation pipelines for the ingestion and normalization of stolen credential files, reducing manual analysis time by 80% and accelerating the dissemination of early warning alerts.