Ibrahim Talbi

Cyber threat detection for IT/OT environments. I work on XSIAM, Google Chronicle and QRadar to validate telemetry and create, tune and maintain detection rules for cloud, endpoint, network and OT data (Nozomi). I run Purple Team Exercice and adversary emulation (MITRE Caldera, APT scenarios, breach & attack simulation) to test whether attacks are actually detected and to measure MITRE ATT&CK coverage. I use scripting and detection-as-code to automate detection testing, coverage reporting and continuous improvement of detection quality.

L2 SOC analyst working for multiple customers in a managed security (MDR) environment. I handled security alerts and incidents across SIEM and EDR platforms including Splunk, Microsoft Sentinel, Sekoia XDR and Defender for Endpoint, investigating endpoint, network and cloud activity to identify malicious behavior. I worked with both SIEM-based and EDR-only customer environments, validating alerts, tuning detections and supporting incident response. I was also responsible for vulnerability management activities using qualys, analyzing exposure, prioritizing risks and supporting remediation based on active threats and detection results.

Conducted SOC analysis missions utilizing Wazuh and ELK. Executed dedicated client assignments, including serving as a SOC Analyst L2 for Bouygues Telecom (Qradar, SEP) and managing a SIEM migration from Splunk to RSA NetWitness for Crédit Agricole. Actively participated in the build and run phases of various SOC projects.

Investigation : L1/L2 Siem SPLUNK - Azure sentinel Vulnerability management : Qualys

ETUDE ET OPTIMISATION D’UN RESEAU ETENDU (WAN) D’ATTIJARI BANK

Étude et mise en place d'une solution de sécurité basée sur les produits Mcafee Stonesoft