Ayoub L.

L2/L3 SOC operations with a core focus on detection engineering. - Detection engineering: rule design and tuning, MITRE ATT&CK-mapped use cases (LogRhythm / QRadar); parser development and false-positive reduction - L2/L3 triage, qualification and end-to-end incident response; forensics, containment, remediation - Threat hunting and CTI analysis - EDR operations (Cortex XDR, Cynet XDR) - Playbook and runbook authoring; SOC process optimization

- Detected, qualified and analyzed security incidents across infrastructure and application layers - Built and operated detection scenarios end-to-end, handling associated alerts - Developed and refined SIEM use cases to expand detection coverage

- Developed automated scanning and vulnerability assessment workflows for networks, web applications and subdomains using Nmap, Amass and the Nessus / Acunetix APIs - Integrated scan results into an ELK pipeline to generate dashboards and technical reports, driving security improvement initiatives

Developed SOAR playbooks for common attack scenarios,