Saifeddine Ammar

Designed and deployed a next-generation Security Operations Center (SOC) architecture with an integrated SOAR platform. Evaluated, selected, and implemented open-source security solutions to enhance visibility, monitoring, and threat detection. Automated incident response workflows by integrating orchestration and SOAR capabilities, reducing manual overhead and improving efficiency. Developed scalable security workflows leveraging automation, log aggregation, and threat intelligence. Technologies: pfSense, Wazuh, Graylog, Ansible, Fluent Bit, Grafana, Shuffle, Cortex, MISP, TheHive.

Created and integrated an Endpoint Detection and Response (EDR) solution within a Next-Generation Firewall (NGFW) to provide enhanced endpoint monitoring, threat detection, and response capabilities. Implemented and integrated Velociraptor after I tested multiple open-source EDR solutions (CrowdStrike, OSSEC, Wazuh, Owlyshields, P-edr). Developed an interface to integrate EDR features (threat detection, incident response) into the NGFW interface. Used Django for back-end and Vue.js for front-end to ensure seamless integration with the existing firewall design.

Implemented a secure CI/CD pipeline for Spring Boot application development, integrating robust tools and methodologies to enhance code security and quality. Leveraged Docker for containerization, SonarQube for static code analysis, OWASP Dependency-Check for vulnerability management, and Renovate for dependency updates. Included advanced tools like Nexus, Trivy for vulnerability scanning, Gitleaks for credential scanning, and OWASP ZAP for dynamic security testing.

Performed vulnerability assessments using OWASP methodologies. Developed a Python-based anti-spam filter utilizing machine learning, and created FTP and open port scanners to identify network vulnerabilities. Designed a network traffic visualization tool integrating Wireshark and google maps to enhance security monitoring.

Designed and implemented a comprehensive security architecture for a Security Operations Center (SOC) tailored to the healthcare sector. Focused on selecting and integrating open-source solutions, optimizing workflows with orchestration and automation, and rigorously testing SOC effectiveness against internal and external attack scenarios while ensuring compliance with HIPAA and GDPR regulations. Tools Used: pfSense, Honeynet, Elasticsearch, Kibana, openEDR, Wazuh, Graylog, Cortex, MISP, The Hive.

Deployed and integrated Splunk, Sysmon, Osquery, and Snort for network monitoring and incident response, correlating data to detect and mitigate threats.