youcef mohamed mahmoud

- Conception d’une nouvelle architecture Splunk pour l’infrastructure IT. - Identification des logs critiques des applications pour la détection DLP/ intrusion. - Centralisation, parsing et indexation des logs. - Études de performance et optimisation du SIEM.

Investigation et réponse aux incidents de niveau 3. Développement de règles de sécurité et DLP adaptées aux risques identifiés. Amélioration des procédures d’intervention et tests de pénétration pour valider les détections. Administration de Trend Micro EDR. Développement et présentation des indicateurs clés de performance (KPI). Développement de règles de sécurité alignées sur l’analyse de risque afin de renforcer les capacités de détection sur Splunk. Normalisation de l’ensemble des cas d’usage dans Splunk pour une meilleure détection des attaques. Optimisation de tous les scheduled searches et dashboards Splunk pour améliorer les performances et accélérer les temps de réponse.

The main EDR and cyberwatch administrator. • Conducting in-depth investigations into cybersecurity incidents, ensuring a rapid and effective response. • Strategic management of cybersecurity projects, guaranteeing optimal coordination and compliance with deadlines. • Advanced administration of the CyberWatch console, maximizing system monitoring and security. • Proacve management of vulnerabilities, significantly reducing risks and strengthening IT resilience. • Targeted benchmarking of cybersecurity tools, contributing to known improvement in security processes. • Close collaboration with the CERT team for the management of critical incidents, strengthening the capacity to respond to threats.

• Management of a specialized team in response to cybersecurity incidents, guaranteeing a thorough and responsive investigation. • Expertise in log analysis and data integrity assurance according to CIM standards. • Design and customization of data models for smooth integration of various types of logs. • Creation of tailor-made Splunk dashboards to optimize the cybersecurity investment process. • Development and implementation of advanced invesgaon scenarios, with precise assessment of technical risks. • Carrying out detailed risk analyzes and developing benchmarks for threat scenarios.

• Cybersecurity expert and Splunk developer within the Use Case Factory specialized in the design of security scenarios and the implementaon of attack detection strategies. • Advanced design of attack scenarios for Linux and Windows operating systems, strengthening operational resilience. • Full development of security use cases on Splunk, ensuring effective monitoring and incident response. • Management of workshops with stakeholders to identify security surveillance requirements and translate them into technical specifications via a dedicated framework. • Known optimization of the security monitoring framework, ensuring proacve technological monitoring. • Responsible for the technical validation of log collection and technical specification of security detection systems, ensuring data integrity and pernency. • Creation and implementation of technical detecon solutions, increasing the response capacity to threats. • Develop security remediaon processes, including investigation and remediation, to minimize the impact of incidents.

Planning and execution of penetration tests on various networks, systems, and applications. Identification of security vulnerabilities and documentation of detailed findings. Collaboration with teams to deliver comprehensive reports with actionable remediation recommendations.

Ransomware Analysis (Malware) on Raspberry PI. A Raspberry PI that plays the role of a transparent Proxy-Cache with an antivirus, a firewall and an IPS for the protection of the internal network of the client against attacks: (DDos, Scans and Brute Force... etc.), Ransomware and malware, by analyzing the traffic that passes through the proxy

Build modules to integrate with a NGFW (Next generation firewall) for testing penetrations on mail servers and FTP. Conducted a series of tests that allow us to detect the flaws present in the mail and FTP servers of our client and to identify them.

security assurance of corporate networks, and firewall configuration

programming and setting up an Intrusion Detection System to secure an E-commerce website using the K-means algorithm. the IDS aims to detect each instrusion or hacking in the system.