Mouhamed Amine Rouissi

Provide L2 technical support for enterprise clients on the Rubrik Security Cloud (RSC) platform, handling both customer-raised and monitoring-triggered tickets Manage end-to-end configuration of Rubrik hardware and software appliances, covering both network-side (connectivity, routing, replication) and host-side (agent deployment, workload onboarding, SLA policy assignment) setup Act as escalation point from L1, troubleshooting complex backup failures, restore operations and data protection anomalies across cloud, virtual and physical environments Ensure adherence to client SLAs for fully managed, immutable and air-gapped backup solutions delivered as a managed service

This project focuses on the design and implementation of an automated SOC integrating a multi-agent AI architecture for cybersecurity incident detection and response. A Wazuh-based SIEM/XDR solution provides centralized log collection and alert correlation, aligned with the MITRE ATT&CK framework. The OpenVAS vulnerability scanner enables continuous CVE monitoring across all assets, enriched with CVSS scores, EPSS exploitation probability and the CISA KEV catalog. The Shuffle SOAR platform orchestrates automated response playbooks, integrating real-time enrichment through VirusTotal, AbuseIPDB, Shodan and MISP. Three specialized AI agents analyze each alert from the perspective of asset context, threat intelligence and AI-assisted decision-making powered by a cybersecurity LLM. Behavioral alerts from Wazuh and Suricata are classified using a custom IAC (Incident Alert Classification) scoring system built across three dimensions: Impact (MITRE ATT&CK tactic weight and rule severity level), Confidence (threat intelligence signals , VirusTotal, AbuseIPDB, MISP , combined with analyst feedback history via RAG), and an Asset Value Multiplier (criticality of the targeted host). Vulnerability findings are separately classified using a four-level DEFCON model based on CVSS score, CISA KEV catalog presence and EPSS exploitation probability. The entire pipeline is monitored through a real-time SOC dashboard and continuously improved through an analyst feedback loop.