Esmail Al_Rahbi

I've supported Security Operations Center monitoring at Yemen Armored Security & Safety, using Wazuh and Splunk to investigate Windows Event Logs, Syslog, and network traffic across client environments.

I triage alerts through detection and containment following NIST 800-61, map IOCs and TTPs to MITRE ATT&CK, and use MISP, VirusTotal, and AbuseIPDB to enrich investigations. I also contribute to threat hunting, SIEM correlation-rule tuning, SOC shift logs, escalation records, and asset inventory.

In a financial-wallet mobile security assessment, I performed Android APK reverse engineering, static and dynamic analysis, runtime manipulation, traffic interception, and API security testing. I identified three critical static-analysis vulnerabilities, including hardcoded API keys rated CVSS 8.5+, and delivered PoC-backed remediation guidance.

I'm building on hands-on work with SIEM, EDR, vulnerability assessment, OSINT, Active Directory, LDAP, and Python automation. I developed Smart Executive Agent, an AI-powered SIEM/SOAR platform designed to process over 10,000 events per second, achieve 94% anomaly-detection accuracy, and reduce analyst investigation time by 40%.