Hamza Elkamouni

• Lead SOC operations and supervise Level 2 analysts. • Deploy and manage SentinelOne EDR from design to production rollout. • Investigate complex security incidents and reconstruct full attack chains (TTPs). • Fine-tune detection rules and create tailored use cases based on business context. • Define SOC KPIs and dashboards for reporting to top management. • Participate in cybersecurity governance committees (COPIL, COTECH). • Collaborate with vendors and contribute to threat intelligence for the maritime sector.

• Conduct advanced threat monitoring and incident response for enterprise clients. • Automate SOC workflows using Mindflow (playbooks, triage, escalation). • Integrate and optimize Darktrace for behavioral threat detection and analysis. • Lead technical workshops (COMAC / COMOP) and propose process improvements. • Perform continuous cyber threat intelligence and advise client SOC teams.

• Handle security incidents from detection to containment and recovery. • Conduct deep analysis and correlation across multiple log sources. • Write technical and executive reports on major incidents. • Maintain and optimize detection rules and SOC knowledge bases. • Support engineering teams with new use cases and automation projects.

• Develop and maintain MITRE ATT&CK–based detection scenarios. • Customize QRadar DSM, correlation rules, and monitoring dashboards. • Collect and normalize logs from various sources (Syslog, WinCollect, JDBC). • Prepare weekly reports and track project progress. • Contribute to continuous SOC process and workflow improvements.