Ahsan Masood

I’m a SOC/SIEM analyst with hands-on experience in threat detection, log analysis, and incident response across Linux and Windows. In my current role, I monitor and triage security events using Wazuh SIEM across a multi-VM SOC infrastructure on Proxmox, turning raw telemetry into actionable investigations.

I also deploy and operate SIEM/EDR capabilities—using an ELK-based EDR (ETARA) with agent enrollment and endpoint quarantine enforcement. I integrate Shuffle SOAR for automated incident response, including firewall IP blocking triggered by SIEM alerts, and I use IRIS DFIR and Cortex analyzers to enrich alerts and manage cases.

Parallel to my SOC work, I build AI-driven detection pipelines. At Care, I train custom YOLO models for real-time object detection and classification, and I develop computer vision pipelines with OpenCV for detection, tracking, and image preprocessing.

My projects reflect how I like to connect security operations with automation and applied AI: SentinelX normalizes telemetry from Wazuh SIEM and Suricata IDS into PostgreSQL, and I built a local private RAG pipeline using Llama3 via Ollama to automate framework compliance mapping with 99.5% JSON validity. I also created an automated quarantine loop using a Ryu SDN controller to push OpenFlow 1.3 host isolation rules within seconds of high-severity alerts, and I’ve supported GRC and cybersecurity training through my internships.