Marouen B.

Provide real-time monitoring of client information systems and threat detection within a SOC built on Microsoft Sentinel (SIEM) and EDR solutions. Operate across the full security incident response lifecycle (detection, containment, analysis, eradication, recovery, post-mortem), including leading the response to a critical DDoS incident. Support the onboarding of new clients onto the SOC and the continuous improvement of detection and incident response processes. Automate SOC operational tasks (Python scripts, API integrations) to speed up alert handling and vulnerability management. Maintain active threat intelligence monitoring and conduct OSINT/CTI investigations to identify malicious campaigns. Produce incident reports and technical documentation for clients and internal teams.

Monitor SIEM environments in real time to identify suspicious activity and anomalies. Conduct OSINT / Dark Web monitoring to detect data leaks and APT campaigns, producing structured threat intelligence (STIX, MISP, OpenCTI). Build internal Python tools automating threat hunting (SIGMA rules, MITRE ATT&CK), CVE reporting, and fraudulent domain detection. Manage security incidents for financial and industrial clients in Tunisia. Deliver professional training in CTI, incident response, and penetration testing across Tunisia and several African countries. Concurrent role: Engineering Intern (Feb 2023 - Oct 2023) — designed and deployed THRIVE, a resilient threat hunting and investigation platform integrating Hoarder, Zircolite, Hayabusa and Kuiper, automating log collection and analysis to accelerate SOC investigations.