wissamarn

Security Analyst operating across the full SOC spectrum (L1 to L3) within an international Blue Team environment, focused on advanced threat detection, engineering, and incident response. • SIEM Monitoring & Detection: Monitor and analyze suspicious events across multi-vendor platforms, including Microsoft Sentinel, Splunk, ELK, LogPoint, and Chronicle, ensuring full visibility into anomalous activity. • Incident Response & Triage: Perform event triage by criticality and drive response actions from initial detection up to L3 containment, leveraging EDR/XDR solutions like CrowdStrike, TEHTRIS, and SentinelOne. • Proactive Threat Hunting: Conduct threat hunting campaigns and vulnerability assessments to uncover hidden threats and persistent adversaries across distributed environments. • Threat Intelligence Verification: Validate high-priority alerts and security incidents using open-source (OSINT) and proprietary intelligence sources. • Incident Management & Reporting: Lead end-to-end incident management, mitigation, and reporting, delivering clear technical post-mortems and remediation strategies. • Client Intelligence & Advisory: Provide international clients with actionable intelligence, technical breakdown of intrusion events, and strategic threat indications. • SOC Engineering & Optimization: Participate in continuous improvement initiatives, including advanced alert design, detection engineering, and SOC workflow optimization.

Contributing to the cybersecurity defense of a critical airport infrastructure by enhancing detection capabilities and incident response across diverse log sources in a high-stakes environment. • Designed and implemented custom detection alerts across various log types (Windows, Linux, EDR, Active Directory, proxy, antivirus, NAS). • Conducted proactive threat hunting leveraging MITRE ATT&CK framework and OSINT investigations using VirusTotal and other threat intelligence tools. • Followed incidents end-to-end, coordinating cross-functionally with IT, infrastructure, and security teams through regular meetings and effective communication. • Proposed and helped deploy SIEM improvement initiatives to optimize detection accuracy and reduce false positives. • Automated reporting and streamlined investigation processes through reusable search templates and data normalization. • Delivered clear summaries of security incidents and recommended mitigation actions to supervisors and relevant teams. • Contributed to maintaining and strengthening the organization’s security posture in a critical infrastructure context.

Developed and implemented a custom Intrusion Detection and Prevention System (IDS/IPS) for distributed systems using Python and packet capture tools (Tshark/Wireshark). • Analyzed network traffic and captured packets to detect scanning and brute force attacks in real-time. • Designed prevention mechanisms to automatically block malicious IPs, ban offenders, and alert administrators upon reaching defined attack thresholds. • Maintained detailed logs and generated PCAP files for forensic analysis and incident tracking. • Focused on minimizing false positives to improve detection reliability and operational efficiency. • Conducted thorough testing to validate system effectiveness, ensuring rapid incident response. • Presented findings and technical documentation at the research lab; project validated by academic supervisor.

Performed comprehensive penetration testing on various web applications using a broad range of industry-standard tools and frameworks. • Identified critical vulnerabilities and exploited security weaknesses to strengthen application defenses. • Developed and deployed a phishing simulation platform to raise user awareness and enhance organizational security culture. • Collaborated closely with development and IT teams to remediate vulnerabilities and implement security best practices. • Authored detailed technical reports and contributed to an article showcasing the team’s research and achievements. • Utilized advanced reconnaissance, exploitation, and network analysis tools including Metasploit, Burp Suite, SQLmap, Hydra, OpenVAS, TheHarvester, Wireshark, and more to conduct thorough security assessments.