YOUNESS ABDELHADI

Lead integration and production deployment of SIEM (IBM QRadar, ELK Stack, Splunk, LogRhythm) and SOAR platforms (Cortex XSOAR ...) within the SOC. Design and tune MITRE ATT&CK–aligned use cases, with a strong focus on noise reduction and risk-based prioritization. Build end-to-end Cortex XSOAR playbooks covering automated triage, CTI enrichment (STIX/TAXII/APIs), analyst-assisted decisioning, containment/remediation actions, and post-incident reporting. Implement multi-tool active response: IP/URL/domain blocking, dynamic PAN-OS/FortiGate rules, endpoint isolation/quarantine (Cortex XDR, Cybereason), AD account disable/reset, and automated moving of phishing emails to the spam folder in O365/Gmail. Develop Threat Intelligence pipelines: multi-feed ingestion, normalization and scoring, orchestrated IOC publication to SIEM/EDR/firewalls, and conditional blocking based on risk score. Establish health checks and observability for SOC platforms: programmatic controls for SIEM ingestion, SOAR jobs, log sources, versions, resources, and error detection, with proactive alerting and auto-remediation. Automate instant technical audits and advanced Excel exports (tables and charts) for firewalls (PAN-OS, FortiGate), SIEM platforms, and EDR (Cortex XDR, Cybereason) using APIs (Elasticsearch, QRadar, etc.). Build and refine governance & case management workflows: ticket templates, SLA/OLAs, escalations, approvals, Teams/Email notifications, traceability, and audit logging. Contribute to database security projects (Guardium, Imperva) by defining and tuning policies for monitoring access to sensitive data and preventing data leakage. Achieved measurable improvements in SOC performance, including reduced MTTD/MTTR, increased auto-remediation, and fewer false positives through iterative deployments.

- Design and implement advanced security automation solutions to optimize SOC operations and incident response workflows - Develop and maintain SOAR playbooks across multiple platforms, including Cortex XSOAR, Splunk SOAR, and FortiSOAR, enabling automated alert triage, enrichment, and response actions - Integrate SIEM platforms such as Splunk, QRadar, ELK (Elastic Stack), and LogRhythm with security tools through scalable API-driven architectures - Build end-to-end automation pipelines to reduce alert fatigue, accelerate investigations, and improve response times (MTTD / MTTR) - Engineer custom integrations and scripts (Python, REST APIs) to orchestrate complex security workflows across multiple systems - Identify automation opportunities within SOC environments and translate them into reliable, production-ready solutions - Apply best practices in automation design, error handling, and system resilience for enterprise-grade deployments This work is conducted alongside my full-time role, focusing on delivering high-quality automation solutions and continuously advancing expertise in SOAR and SIEM ecosystems. Core expertise: - Security Automation & SOAR (Cortex XSOAR, Splunk SOAR, FortiSOAR) - SIEM Integrations (Splunk, QRadar, ELK, LogRhythm) - REST API Integrations & Scripting (Python) - Incident Response Automation - Alert Enrichment & Workflow Orchestration Selected impact: - Reduced manual SOC workload through automation of alert triage and enrichment workflows - Improved incident response efficiency by implementing scalable SOAR-driven automation pipelines

Performed IoT vulnerability analysis and supported network anomaly detection initiatives. Created Python-based automation for log analysis and security reporting, improving visibility and reducing manual effort for security teams.