Hamza AZIZ

- Manage security event handling via SIEM ELK and administer HarfangLab (EDR): detection, triage, investigation, IOC hunting, policy tuning, and maintain a SIEM/EDR catalog (use cases, risks, MTTD). - Develop and maintain detection rules (KQL/Elasticsearch), dashboards (KPI/KRI), and automate log collection (Python/Bash, PowerShell scripts). - Oversee periodic security controls (reviews, tests, corrective actions) and prepare/close internal audits (evidence, remediation). - Publish security indicators, dashboards, and reports for management, conduct technological and cyber monitoring (CERT-FR, CVE bulletins, CISA). - Leverage CybelAngel for detecting exposures and sensitive data, strengthen security posture: anti-phishing with Riot Albert, Mimecast, Defender, analyze email incidents (phishing, malware). - Supervise DLP policies (detection, exfiltration, false positives), integrate security into projects (architecture reviews, requirements, compensating controls). - Administer IAM SailPoint (role models, recertifications, access reviews) and Azure AD (SSO, MFA, Conditional Access, privilege management). - Implement Microsoft 365/Azure controls (Defender, Purview), develop automation scripts for detection, response, and reporting. - Contribute to crisis management (communication, post-mortem) and participate in Cloud design, apply best Big Data practices, and lead Palo Alto, Fortinet configuration testing, proposing hardening measures. - Update security policies, document threat postures (TTPs, MITRE ATT&CK), map and prioritize gaps.

Lead the collection of logs from various sources for the SOC transformation program. Coordinate and facilitate internal briefings with clients and SOC management to execute strategy. - Manage project execution and documentation of deliverables, controlling scope and applying change management processes. - Monitor project timelines and communicate any deviations/changes. - Identify, manage, and proactively communicate project risks and issues. - Define and allocate a clear and sufficient budget to achieve project goals. - Communicate process updates, KPIs, and best practices to the PMO and relevant AXA entities. - Perform checks on parsers to ensure detection rules (use cases) trigger as expected. - Lead testing and tuning of detection rules with SMEs and internal teams. - Integrate data from SOC vulnerability management teams to enhance detection rule development. - Ensure critical vulnerabilities identified by upstream teams are incorporated into analyses and deployed rules to strengthen threat coverage. - Collaborate with IT and network teams to align log collection and remediation of critical vulnerabilities with business priorities. - Draft technical and architectural documents in collaboration with the design authority team. - Define requirements, milestones, and plan the project lifecycle. - Ensure high-quality contractual deliverables from service providers or internal SOC teams. - Facilitate the sharing of quality feedback with analysts and data owners to ensure optimal data for future analyses. - Organize troubleshooting sessions and coordinate with team members to resolve log collection issues.

- Authored technical and security architecture documentation for clients. -Participated in pre-sales and commercial activities: drafted technical offers, led POC/POV initiatives for cybersecurity solutions. - Ensured high service delivery standards through regular KPI tracking, customer satisfaction reviews, and continuous improvement. - Acted as single point of contact (SPOC) for 60+ SOC clients: provided management with detailed reporting on service performance and critical vulnerabilities. - Managed SOC transitions and defined service and organizational plans. - Led Build & Run SOC projects: implemented SIEM solutions (QRadar, ELK), ensured efficient log collection and integration. - Conducted client workshops to define operational/technical procedures, perform risk analysis, and design detection use cases (generic and client-specific). - Supervised SOC analysts (L1 & L2): resource allocation, ticket management, SLA compliance, and incident response tracking. - Performed quality reviews on monitoring and incident response activities. - Oversaw staff management: recruitment, training, performance evaluations. - Managed vulnerability lifecycle using tools like Rapid7 and Nessus; developed workflows for identification and prioritization. - Integrated threat intelligence (Recorded Future) into SOC processes. - Coordinated vulnerability scans and remediation with IT teams. - Led crisis management for major incidents, ensuring coordination with MSSPs and internal cybersecurity teams.

• Quality Assurance Review: QA Processes / Projects / Heritage • Lead and facilitate management review • Define, redesign and improve the processes and implementation of the standards and methods of the organization while remodeling the process map and reengineering older and obsolete processes in a simpler and lighter way for the end-user • Integrate risk management practices and culture into the way staff undertake their jobs, and business units achieve their objectives through the implementation of the RSCA method • Agile project management (Management of costs, deadlines, risks and quality) • Execute IT control plans on multiple departments of the organization / Internal auditing • Ensure operational efficiency with teams using the group's methodologies (Lean, Design thinking, Co-workings, Coaching, etc.) • Monitoring of the Project Portfolio and Coordination between the Business Units of the IT systems department of the African Region Management of the SQL developer database for the project management tool • Performs overall end to end project management activities from matching and mapping until the project is handed over to operations

• Design and creation of an XML file management application (containing transactions stored on the client server) as well as developing other features using Java • Support the IT team in maintaining hardware, software, and other systems • Assist with troubleshooting issues and provide technical support • Third-party application maintenance (TMA): make improvements on applications using Java, C#, PLSQL • Analysis and treatment of incidents as well as problems on the client applications(Siebel, Maxxing, Bofi)