Oussama MENASRIA

– Handle and analyze security incidents escalated by Level 2 analysts. – Coordinate containment and remediation actions with relevant stakeholders. – Document incidents and propose improvements to response procedures. – Conduct hypothesis-driven threat hunting. – Correlate telemetry and contextual data with findings from continuous threat monitoring. – Share hunting outcomes and contribute to the refinement of detection logic. – Review existing use case coverage to assess detection efficiency and identify blind spots in both coverage and telemetry collection. – Develop and maintain new detection use cases integrating statistical deviation from behavioral baselines to detect anomalous activity. – Build new detections and close coverage gaps revealed during Red Team exercises. – Maintain documentation and continuous improvement tracking for use cases. – Define requirements for automation workflows using XSOAR and Google Chronicle SOAR to improve triage and response efficiency. – Collaborate with automation engineers to automate enrichment and containment steps.

– Analyze and respond to security incidents including compromises and Red Team exercises. – Coordinate containment and remediation actions with technical teams. – Document incidents and recommend detection and response improvements. – Conduct hypothesis-driven hunting based on observed activity and context. – Correlate telemetry with insights from continuous threat monitoring and behavioral baselines to validate or reject hypotheses. – Share hunting results and update detection logic accordingly. – Develop and tune detection use cases integrating statistical deviation from established behavioral baselines. – Combine correlation and anomaly-based logic to improve detection accuracy. – Integrate new log sources and implement custom parsing in Logstash. – Propose detection blind spots and guide Purple Team scenarios to validate and strengthen coverage (VECTR).

– Serve as technical reference for the L3 SOC team. – Investigate ransomware, compromises, and data-leakage incidents. – Produce structured incident reports and improve response processes. – Execute hypothesis-driven hunting. – Correlate anomalies with continuous threat monitoring. – Perform forensic analysis on compromised assets with SANS SIFT, Plaso, Timesketch. – Define and refine detection logic (EDR & SIEM). – Integrate CloudWatch logs and analyze GuardDuty alerts. – Develop investigation templates and structured questionnaires. – Support deployment of Claroty probes for SCADA monitoring.

– Create parsing rules in Logstash. – Enrich DNS and Proxy logs using OSINT (Alexa Top-1M, entropy calculation, WHOIS). – Define IOC-based detection rules and create Kibana dashboards. – Analyze and respond to alerts from logz.io (Elastic stack SaaS) & Microsoft Cloud App Security. – Implement detection rules in Microsoft Cloud App Security (Office 365). – Manage vulnerability scans (Rapid7/Outpost24) and remediation.

– Provide consulting and technical analysis to ensure secure deployment of web applications (classic web, Web Services: XML, JSON/REST, X.509 certificate-based authentication). – Design and implement WAF architectures and security policies for applications hosted on-premises and in cloud environments (Azure, AWS). – Build and maintain security dashboards (Kibana) to monitor web attack patterns and false positives, applying proactive policy tuning. – Analyze and respond to web-related security incidents and define countermeasures through WAF or application-level fixes. – Create reusable F5 ASM security policy templates by application type (Web, XML, REST) – Act as regional technical reference for F5 ASM/LTM, providing Level-3 support to WAF engineers in Southern Europe (Italy, Spain, Portugal). – Author operational and troubleshooting documentation to support WAF operations.

– Analyze and respond to alerts from FireEye NX and define appropriate containment and remediation actions. – Conduct malware analysis (static and dynamic) in sandbox environments to understand targeted attack behavior. – Design, implement, and administer IDS/IPS solutions (Juniper IDP, Palo Alto), including development of custom detection signatures. – Perform web application penetration tests and coordinate mitigation measures (WAF configuration, patch validation, developer guidance). – Lead the design and deployment of F5 BigIP LTM/ASM WAF architectures, defining per-application security policies and writing operational runbooks. – Manage integration and configuration of Websense Security Gateway Anywhere and Bluecoat SG proxies for secure Internet access. – Conduct vulnerability assessments, patch audits, and compliance checks (SOX, CIS benchmarks) across production systems. – Evaluate and test SIEM solutions (Splunk POC) to improve event correlation and centralize monitoring. – Contribute to the definition of Security Assessment and Secure Development Life Cycle (SDLC) processes for internal IT platforms.