Open to opportunities

Fehd Khayati

@fehdkhayati

Message

I build AI-driven SOAR workflows that automate SOC detection, triage, and response.

Tunisia

Message

What I'm looking for

I'm looking to build AI-augmented SOC and SOAR capabilities, automate detection and response workflows, and contribute to technical incident response in security-focused environments.

At Deloitte, I consult on incident response and security audits for regulated industries. I built a Vulnerability Operations Center and led forensic evidence collection and attack-timeline reconstruction for a cross-border investigation with Deloitte France.

Previously at TuDigiSec by Nomios (Sodexo Group), I eliminated manual Tier-1 triage through an AI-driven SOAR platform using AI agents and a Microsoft Teams conversational interface. I also automated 90% of manual Tier-2 and Tier-3 security work across detection, triage, enrichment, and response.

My workflows connect QRadar, CrowdStrike, Proofpoint, Tines, IBM Resilient, Qualys, Shodan, VirusTotal, AbuseIPDB, Microsoft Entra ID, and firewall APIs. This reduced false-positive escalations by 50%, IOC analysis time by 45%, and incident containment MTTR by 60–80%.

I'm a Tines Bronze Power Builder, ranked in the top 1% globally in 2024 and 2025. I'm also building a multiagent AI SOC architecture with Multica to coordinate detection, investigation, and response across the SOC workflow.

Experience

Work history, roles, and key accomplishments

Current

Cybersecurity Consultant

Current

Deloitte Consulting

Jan 2026 - Present (8 months)

Built a Vulnerability Operations Center and led forensic evidence collection and attack-timeline reconstruction on a cross-border incident investigation. Ran technical control assessments against the B13 standard and strengthened detection coverage for a banking-sector ISMS deployment.

Incident Response SOC Automation Engineering Vulnerability Management Evidence Collection Incident Timeline Reconstruction B13 Standard Detection Rule Development Logging Architecture Response Workflows

Cybersecurity Engineer

TuDigiSec by Nomios (Sodexo Group)

Mar 2024 - Dec 2025 (1 year 9 months)

Eliminated manual Tier-1 triage by architecting autonomous triage through an AI-driven SOAR platform, cutting MTTD to near-instantaneous. Automated 90% of manual Tier-2/Tier-3 work and reduced false-positive escalations by 50% by orchestrating the full security architecture into unified SOAR workflows.

SOAR Security Automation AI Agents Microsoft Teams QRadar Crowdstrike ProofPoint Tines IBM Resilient REST APIs Qualys Shodan Virus Total AbuseIPDB PAM Microsoft Entra ID Microsoft Graph Firewall APIs Incident Response

SOC Engineer Intern

Amen Bank

Feb 2023 - Sep 2023 (7 months)

Stood up SIEM, case management, and threat intelligence operations by deploying and configuring Splunk, TheHive, Cortex, and MISP. Cut deployment time by containerizing the SOC stack with Docker and built automated alert enrichment feeding TheHive cases.