Pakistan Action

Our Job Roadmap

2BuildYou build one real project, with a US company.
  • You join a real project with a US company.
  • You get a supervisor and a deadline.
  • At the end you get a reference an employer can call.
  • Build the project below. It uses real job ad words.
  • Put it on GitHub. Write a clear README.
  • Record a 60-second video of it working.

Build this one

A small SOC that uses AI

Build a security lab. Write the alert rules. Add AI that reads the alerts for you.

Most students show a course badge. You will show a system you built and measured.

  1. Set up the labOne Linux machine. Install Wazuh. Send it real logs.Linux · SIEM · log ingestion
  2. Write the rules12 to 15 alert rules. Link each one to a MITRE ATT&CK technique.Sigma · MITRE ATT&CK · detection engineering
  3. Test themRun safe attack tests on your own lab. Screenshot each alert.adversary emulation · testing · triage
  4. Add the AIA small Python script. It asks an AI to explain each alert in plain words.Python · LLM API · prompt design
  5. Measure itCount false alerts before and after. Time how long triage takes.evaluation · false-positive tuning · metrics
  6. Write it upA clear README, three alerts you solved, and a 60-second video.documentation · incident write-up

The words this puts on your CV

LinuxSIEMWazuhSigmaMITRE ATT&CKdetection engineeringPythonincident triagelog analysisLLMprompt designevaluation

Everything you need — free

WazuhFree SIEM. Runs on one machine.SigmaThe rule format everyone writes detections in.MITRE ATT&CKMap every rule to a technique here.Atomic Red TeamSafe tests that make your own rules fire. Your lab only.

Build it with us and you get a supervisor, a deadline, and a reference an employer can call. Ask about that →

3ShowWe rewrite your CV and LinkedIn.
  • Your headline says the problem you solve, not your tools.
  • We use the same words as the job ads.
  • CV: one page, PDF. No tables. No photo.
  • Projects go before education.
  • We pin your project and video to LinkedIn.
  • We turn on “open to work” for remote jobs.

Weak and strong

Weak

“Student at UET Lahore | Passionate about Cybersecurity | Seeking opportunities”

Strong

“I secure multi-tenant cloud setups against the gaps scanners miss — Wazuh, Sigma, MITRE ATT&CK | Open to remote”

4EmployerWe help you reach the right person.
  • We find the right person at each company.
  • You comment on their posts for 2 to 3 weeks.
  • Say something useful. Never write “great post”.
  • Then send one short message. No CV attached.
  • Send your project and your video.
  • When they reply, offer 1 month of free work.
  • They keep the work either way.
  • If they ask how they can pay you: a direct contract, or an employer of record.
  • Follow up once after a week. Then move on.
  • 1 or 2 replies out of 10 is normal.

The three messages

1The commentWeeks 1–3, several times

We saw a similar latency spike when scaling vector search. Moving from a naive KNN search to an HNSW index cut our retrieval time by about 40% without hurting context quality — curious whether the same holds at your volume.

2The messageOnly once they have engaged with you

Hi [name] — loved your breakdown on protecting user data during third-party API ingestion. I recently built a proxy layer that masks PII in transit for a similar microservice setup. Here is a 60-second Loom of the workflow: [link]. Thought it might be useful to your team.

3The offerOnly after they reply

I know you are moving fast. Let me take [one task] off your plate — one month, free. If it is good we can talk about a remote role. If not, you keep the work and we part as friends. No risk on your side.

Stuck on one of these four?

Tell us where you are. A person who has hired for these jobs will reply.

Start here →

Longer written guides, if you want them →