Yvon Tran

Within the SecOps department, I managed Servier’s outsourced SOC. Key responsibilities: - Managed the SOC service operated by an external provider - Ensured quality and compliance of delivered services - Contributed to the implementation of detection rules based on the Information Security Policy (ISP) criteria - Participated in projects for deploying new security solutions Tools/Environment: Microsoft Sentinel, Microsoft Defender for Endpoints, Trellix, MITRE ATT&CK, ServiceNow

Main missions: SOC Detection Expert - French hospitals - Designed and implemented detection use cases based on the MITRE ATT&CK framework - Created and optimised detection rules, reports, and Splunk dashboards - Assisted the SOC team in SIEM configuration (parsing, lookups, macros, Security Essentials, Enterprise Security) - Contributed to the design of a detection toolkit for European hospitals - Drafted a detection strategy for European hospitals SOC Lead Analyst - Professional services network - Designed and optimised detection rules, reports, and dashboards - Drafted alert handling procedures for Tier 1 analysts - Investigated escalated alerts and assisted in incident response - Communicated security incidents to the customer and promoted best practices - Led technical committees and presented findings - Structured and documented SOC internal processes - Identified areas for SOC improvement and proposed enhancements - Supervised Tier 1 and Tier 2 analysts Alongside customer engagements, I contributed to the management of the SecOps department: - Managed a team of consultants and interns - Participated in department operations (staffing, presales, client need assessments, etc.) - Conducted short-term expert missions (technical support, training and mentoring consultants on operational issues) - Defined, led, and supervised internal lab topics (Splunk, Active Directory, etc.) - Took part in recruiting consultants, interns, and apprentices

Key responsibilities: - Managed the lifecycle of detection use cases (rules and reports) - Communicated business needs and context to the Use Case Factory - Coordinated the factory’s delivery for various business units

Main missions: IT Security assistance – Reinsurance company - External SOC operations follow-up - Handling and tracking security alerts (SIEM, EDR) - SIEM migration follow-up and definition of security detection rules - Simulated phishing campaigns - Abuse activity : email security analysis - Proof of concept on SecBI platform Splunk expertise – Public sector financial institution Log parsing analysis and enhancement to comply with CIM (Common Information Model) standard Internal projects/tasks - Mentorship of interns/junior consultants - Definition and follow up of internship projects including: - The implementation of a Splunk lab - The design of a AD test lab with Splunk and Cybereason (purple team)

Main missions: Incident response plan enhancement – Bank Definition of incident response procedures for each type of threats, including technical processes for L1 SOC analysts Security expertise and assistance for IT projects – Rail transportation company End to end cybersecurity assistance for projects, security needs expression, risk analysis, review and validation of technical architectures, redaction / review and validation of technical hardening guides, project security acceptance… CRM application security management – French television channel Supporting the CISO in securing the CRM platform project: continuous risk analysis and day-to-day security assistance in the solution development, management of security audits and security streams of the project… Security audit for a resources management application – Electricity utility company Analysis of security needs and existing procedures, penetration tests and configuration review, formalization of a risk analysis and a remediation plan based on the security recommendations Security operational monitoring strategy – Bank Definition of a monitoring and incident management strategy based on customer’s security needs, including technical logs to be collected, alerts use cases and rules to be implemented, design incident monitoring and management processes Active Directory hardening – Market research company Redaction of an Active Directory hardening standard and its implementation procedures, assistance for implementing these measures, log normalization and correlation with Splunk solution

Stage en sécurité des systèmes d’information : Analyse des différentes solutions SIEM du marché afin d'évaluer leur capacité à répondre à des exigences opérationnelles rencontrées par les clients telle que la collecte, la normalisation, la corrélation de logs matériels et applicatifs, ainsi que la création d'alertes et de tableaux de bord. Installation, configuration et utilisation au quotidien des solutions Splunk, AlienVault OSSIM et IBM QRadar. Réalisation d'une étude (PoC) sur les injections de code dans des applications Android dans le but d'évaluer les applications de détection de malwares.

Stage en Développement et Systèmes d’Information - Réalisation et maintenance d'un intranet (Zend) - Réalisation d'une application de gestion de taux d'application - Uniformisation de SI : étude des systèmes d'information des entités du Groupe en vue d'uniformiser les SI et d'intégrer une solution ERP

Stage en développement de logiciel web type communautaire en PHP sous framework Symfony en apprentissage Intégré au sein d'une équipe internationale, j'ai pris part au développement d'un réseau social professionnel visant les pays du MENA (Middle East and North Africa). Méthode Agile Scrum • Conception de l'application • Développement de l'application • Tests (unitaires et fonctionnels) • Intégration