horra hayfa

Managed SIEM and XDR platforms to detect, investigate, and respond to security threats in real time. Conducted email threat analysis to block phishing attempts and strengthen organizational defenses.

Implemented SOAR automation with TheHive, Shuffle, and Cortex to streamline incident response. Built playbooks and automated threat intel ingestion (e.g., VirusTotal) to enrich alerts and reduce false positives.

Developed and operationalized an advanced SOC with automated workflows and integrated threat intelligence sources. Designed SOAR playbooks to triage alerts, analyze IOCs, assign incidents, and initiate remediation actions.

Performed malware analysis and detection and built a service to collect and analyze TLS 1.3 certificates for security monitoring. Used tools and platforms including YARA, ClamAV, VirusTotal, and multiple SIEM/SOAR ecosystems to support incident response and C2 identification.

Developed an ML system to detect malware and phishing URLs using decision trees, random forests, and logistic regression (98.46% accuracy), including analysis of PE files and URL classification. Prepared charts and graphs for social media posts to enhance engagement and brand visibility.

Configured and deployed SimpleRisk for risk management using OWASP, CVSS, Classic, and DREAD to define scoring and mitigation strategies. Also managed a Cowrie honeypot with Prometheus and Grafana dashboards and implemented AWS IAM controls for least-privilege access.

Designed a secure campus network topology and device configuration using VLANs, routing, and multiple network security controls. Implemented DHCP and OSPF, configured HSRP and inter-VLAN routing, and added firewall zones, inspection policies, and IPsec VPN.

Worked with SIEM and XDR platforms to detect and investigate threats in real time. Conducted email threat analysis to block phishing attempts and malicious content.

Maintained and optimized security infrastructure while leading cyber awareness initiatives to improve end-user resilience. Enhanced OT environment security through continuous monitoring, risk assessment and mitigation, and implemented Zero Trust principles across IT and OT systems.