Amin GHELIS

– For a pharmaceutical group, development of Python-based tools to automate the periodic review of industrial firewall filtering policies (730 Palo Alto Networks firewalls across 80 sites). – The tool is able to analyze unused rules, rule usage coverage, expired temporary rules, and more. – Development of a Python Flask interface to display review results on dashboards, with export functionality in a format compatible with the internal ticketing system. – Review of network flow opening requests and implementation of the Purdue model (IEC 62443).

– Deployment of the Cortex Data Lake SIEM solution and Cortex XDR EDR solution, which also acts as a log collector. – Integration and parsing of multiple log sources into the SIEM platform (Email Gateway, Active Directory, asset inventory, Linux audit logs, Wallix Bastion, etc.). – Development of Python scripts to transfer logs from cloud security solutions (Zscaler / Netskope) into the on-premise SIEM. Example tool: https://github.com/amghelis/netskope-api-events-retriever – Development of Python scripts to execute automated incident response playbooks. – Development of an internal tool to generate network flow matrices as part of a network segmentation project (Python / ReactJS / Flask). – Cybersecurity incident response, log analysis, and alert triage. – Vulnerability management and patch tracking using Rapid7 InsightVM. – Creation of a cybersecurity compliance dashboard using the ELK stack. – Cybersecurity consulting for the group's IT projects. – Management of EDR deployment and updates across the company's workstation and server fleet.

– Installation and deployment of the SOC infrastructure (server racks, firewalls, SAN storage, etc.), including configuration of the virtualization platform. – Implementation of network segmentation and deployment/administration of firewall rules (Stormshield, Palo Alto). – Deployment of the SIEM solution (Splunk). – Implementation of log collection from physically isolated networks (using data diodes for one-way data flows). – Deployment of log collection scripts for systems that do not support native log forwarding (e.g., databases). – Integration of security devices into the SIEM (IDS, IPS, EDR, etc.). – Creation and maintenance of detection rules. – Development of dashboards and security KPIs.

– Tier 3 incident response and digital forensics. – Deployment, administration, and operation of the Tenable.SC + Nessus vulnerability scanning solution. – Creation of dashboards and reports concerning dedicated perimeters for vulnerability remediation. – Monitoring of patch management. – Implementation of correlation rules and User Behavior Analytics (UBA) within the Splunk solution. – Log analysis for security alerts. – Web application penetration testing. – Wi-Fi infrastructure penetration testing.