Amine Gharbi

○ Conduct technical investigations for major incidents, combining endpoint, network and system artefacts to reconstruct attacker activity and validate or refine existing detections. ○ Conduct proactive threat hunting using SIEM and endpoint telemetry to detect stealthy adversary activity (lateral movement, credential abuse, data exfiltration), with systematic feedback into monitoring use cases. ○ Collaborate with client SOC teams to develop and refine detection use cases and correlation rules to improve coverage and reduce false positives, leveraging threat intelligence and MITRE ATT&CK. ○ Support customers in reviewing and strengthening endpoint protection and antimalware configurations based on incident findings and emerging threats. ○ Deliver technical incident reports, root cause analysis and post-incident recommendations to strengthen monitoring, endpoint protection and response controls. ○ Contribute to alignment of response procedures and monitoring controls with customer governance and regulatory requirements. ○ Research newly disclosed CVEs and emerging threats to identify relevant IOCs, proactively enriching internal detection tools and advising customers on potential exposure and mitigation.

○ Investigated complex alerts raised by SIEM, endpoint protection and network monitoring platforms across multiple customers, identifying real intrusions and preventing impact on critical assets. ○ Actively contributed to the refinement of correlation rules, thresholds and enrichment logic to reduce false positives while preserving or improving detection coverage. ○ Monitored the effectiveness and coverage of endpoint protection deployments (e.g. unprotected or outdated systems) and coordinated with customers to remediate gaps. ○ Supported customer security teams during crisis situations by explaining detection logic, investigation findings and recommended containment actions or by providing containment during major events or customer escalations. ○ Contributed to cross-functional security projects and knowledge transfer (training sessions, procedures, internal documentation).

○ Performed second-level analysis of security events and transformed raw SIEM alerts into fully qualified incidents with clear technical and business impact assessments. ○ Supported implementation and fine-tuning of new security tools including SIEM platforms, log management solutions and EDR agents. ○ Assisted in the design and tuning of SIEM detection content (correlation rules, dashboards, alerting) to improve monitoring effectiveness. ○ Performed system hardening activities based on audit findings, addressing identified weaknesses and aligning configurations with security best practices and compliance requirements. ○ Created detection guides and investigation templates to support knowledge sharing and onboarding of new analysts. ○ Conducted vulnerability assessments and contributed to remediation planning for network and system weaknesses. ○ Delivered security awareness training sessions to customers, including simulated phishing campaigns to assess user behavior and improve resistance to social engineering attacks.

○ Provided 24/7 monitoring and triage of security alerts, ensuring prompt validation and escalation of verified threats according to SLAs. ○ Applied investigation playbooks to validate alerts, correlate events, and gather supporting evidence for L2 review. ○ Stayed up to date with CVEs and threat intelligence, proactively informing clients when systems were exposed or at risk. ○ Flagged recurring false positives and noisy use cases, contributing to the tuning of alerting thresholds and logic. ○ Participated in routine health checks of security tools and assisted in onboarding new log sources into SIEM. ○ Supported daily SOC operations including log parsing verification, incident handovers and playbook execution.