taoufik salmi

As Tech Lead, leading the deployment of cybersecurity solutions for OT/IT environments within OCP Group, ensuring secure integration and interconnection with the IT SOC, within a team of 9 members. o Design and implementation of cybersecurity architecture tailored to OT environments, ensuring seamless integration with existing IT infrastructure. o Evaluation, selection, and recommendation of key security solutions: EDR, IAM, sandboxing, firewall, and SIEM. o Conducting feasibility studies and technical analyses, contributing to budget scoping in coordination with project managers, OCP subsidiaries, and partners. o Participation in RFP processes with the OCP project manager. o Technical leadership and supervision of security solution deployments. o Coordination with industrial site teams for technical integration, connectivity testing, and functional validation. o Initial configurations and security policy implementation. o Coordination of technical acceptance tests, operational documentation, and knowledge transfer to OCP teams. o Support and coordination for cybersecurity audits conducted by external auditors, including preparation of technical evidence and follow-up of recommendations. o Conducting OT/IT risk assessments and implementing appropriate security controls. o Contributing to alignment with ISO 27001 requirements. Technical Environment : Palo Alto, Trellix, Wallix, Acronis, Nozomi.

Contributed to both build and run phases of the SOC during Azure migration within a team of 12 members. o Supervision of CSIRT analysts ensuring structured and rapid incident response. o Design and deployment of a standardized incident management protocol, reducing MTTR by 45%. o Cross-team collaboration to enhance overall security posture. o SOC adaptation during Azure migration, covering cloud resources integration into Azure Sentinel, log source onboarding, as well as detection and automation optimization. o Development of playbooks using Azure Logic Apps. o Advanced investigations and threat hunting activities. o Penetration testing and attack simulations to validate SOC detection capabilities.

Participated in SOC deployment within a team of 5 members. o Deployment of Wazuh EDR and ELK stack with SOC process automation. o Development of Threat Intelligence modules using external APIs and Dark Web sources. o Targeted penetration testing to validate detection mechanisms. o Incident handling and response. Technical Environment: Wazuh, ELK, Python, OpenCTI, Kali Linux, TheHive, Grafana.

members. o Deployment and configuration of EDR, SIEM, NSM, Sandbox, and CTI solutions. o Log integration and normalization for centralized correlation. o SIEM configuration and optimization. o Trellix sandbox configuration for dynamic and behavioral malware analysis. o Implementation of CTI enrichment capabilities. o Incident management and response. o SOC process automation using Python scripts and pipelines. o Continuous optimization of detection rules and operational workflows. o Penetration testing to validate SOC detection capabilities. o Creation of internal knowledge base and procedures. o Training and mentoring SOC analysts. Technical Environment: Trellix (EDR, SIEM, Sandbox, CTI), Palo Alto, FortiGate, Arbor, cyberArk, F5 WAF, DLP Digital Guardian, Cisco Ironport, Kali Linux, python, Burp Suite.

Worked within a 10-member SOC team responsible for cybersecurity infrastructure monitoring. o In-depth analysis of security and network incidents (SIEM alert triage, severity assessment, false positive elimination). o Participation in incident management meetings with strategic and operational recommendations. o Detailed documentation of incident tickets and remediation plans. o Technical reference within the team, mentoring junior analysts. Technical Environment : Splunk, QRadar, Grafana, Cybereason, Symantec.