Nhat (Dinh) Phan

It started with wanting to know how things break

I enrolled in Cyber Security at the Hanoi University of Science and Technology in 2021, though the lessons that actually stuck came from CTF arenas, not lecture halls. Web exploitation became the obsession. Every broken authentication flow and injection point was a puzzle I couldn't put down, and that itch to understand why a system fails is still what drives everything I do.

From the arena to the enterprise

Picked as a top-50 Viettel Digital Talent, I spent my intern months buried in NIST CSF and CIS Controls, my first real taste of security at organizational scale. That opened the door to Viettel Group Headquarters, where I authored the group-level information security regulation and ran audits across every business unit in Vietnam and its overseas subsidiaries. I learned that finding a flaw is only half the work. The other half is turning it into policy people will actually follow.

Hands on the keyboard when it counted

As a Tier-3 SOC Analyst at Viettel Cyber Security, I moved from writing the rules to living inside the incidents. I hunted advanced threats and persistence across group-wide infrastructure, drove investigations through deep log analysis from first alert to root cause, and owned the response end to end, from containment through the findings that kept it from happening twice.

The hunt

Today, as a Cyber Threat Intelligence Analyst at Alice (formerly ActiveFence), I track phishing campaigns end to end, from static kits piping credentials to Telegram bots, to Browser-in-the-Browser popups and WebSocket kits validating stolen logins in real time. I reverse malicious browser extensions, tear infostealers apart from cookie theft to C2, and map adversary infrastructure into client-facing reports built on MITRE ATT&CK. The curiosity that started in a CTF box is still what protects platforms at scale today.

Still curious. Still breaking things to understand them.