Abd El-Rahman Khalid

- SOC Building and Optimization - Design and implement the Security Operations Center (SOC) infrastructure to meet organizational security requirements. - Develop and maintain SOC policies, procedures, and playbooks to standardize incident detection and response. - Integrate security tools and platforms (Splunk, Palo Alto, F5, Microsoft Defender, OCI, NSX) to enhance threat visibility and correlation. - Perform gap analysis to identify weaknesses in the SOC environment and recommend improvements.

In my role, I support the overall information security posture by investigating and responding to security incidents, performing threat hunting, and designing use cases tailored to emerging threats. I assess and support compliance with standards such as GDPR, PCI, and ISO, ensuring alignment with regulatory requirements. My responsibilities also include conducting threat intelligence operations and reporting on findings to proactively address potential risks. • Support and audit PCI, GDPR and ISO 27001. • Develop and enforce security policies and procedures. • Provide threat intelligence and incident reports. • Conduct cyber investigations, forensic, malware, and threat analysis. • Design and implement security solutions and models for infrastructure, applications, and network architecture. • Monitor, triage, and respond to security incidents using various security appliances: • EDR: Trellix EDR - Microsoft Defender - Wazuh XDR. • SIEM: Microsoft Sentinel – Splunk. • Threat Intel: SOCRadar – MISP. • End Point: Prisma Cloud Security - Kaspersky – Symantec. • Network Security: (Forti – Paloalto) Firewalls (F5 – Barracuda) WAF.

monitors and responds to security alerts, performs initial threat analysis, and escalates incidents. • Monitoring: Continuously watching security dashboards and alerts. • Incident Response: Investigating and responding to security incidents. • Threat Analysis: Conducting initial assessments of potential threats.

During this Intern, we started from the basics until I was able to perform practical investigation and Incident Response on production, performing various techniques using Qradar and other security appliances along with MITRE framework during an investigation. • Network Security and Appliances. • Dealing with Domain Environment, Active Directory. • Handling Linux servers, users, and privileges. • Endpoint Security Solutions. • MITRE ATT&CK and attacker tactics and techniques. • Incident Handling phases. • Hands-on training on “IBM Qradar” SIEM Solution. • Practical Threats Investigation.

Military service

Receives and looks into alerts daily. Reviews the most recent SIEM alerts to see their relevance and urgency. Carries out triage to ensure that a genuine security incident is occurring.

CCNA training at National Telecommunication Institute.