Open to opportunities

Iheb Mabrouki

@ihebmabrouki1

Message

I deploy Kubernetes-based security platforms and automate detection, investigation, and incident response workflows.

Tunisia

Message

What I'm looking for

I'm looking to build and operate security platforms where I can combine Kubernetes, detection engineering, threat intelligence, and automation to improve investigation and response outcomes.

I designed and deployed a 25+ service, air-gapped security platform for Attijari Bank on K3s, integrating OpenCTI, MISP, TheHive, Cortex, Wazuh, Security Onion, and Suricata. I owned its infrastructure design, orchestration, integration, troubleshooting, documentation, and automation end to end.

I built four SOAR playbooks and a 15-service LangGraph multi-agent analysis pipeline with RAG search over log archives, reducing mean time to detect by 76% and mean time to respond by 72%.

At MB Tech, I operated open-source SIEM and network-detection tooling, onboarded and normalized logs, tuned detections, investigated alerts, performed endpoint forensics, and supported penetration-testing engagements. I work comfortably in remote, asynchronous environments and produce practical runbooks and architecture documentation.

Experience

Work history, roles, and key accomplishments

Security Engineer (Graduation Project)

Attijari Bank

Jan 2026 - Jul 2026 (6 months)

Designed and deployed a 25+ service security platform on a K3s Kubernetes cluster, integrating threat intelligence, case management, and detection tools. Built automation layer with SOAR playbooks and multi-agent pipeline, reducing detection and response times by 76% and 72% respectively.

Kubernetes K3s Helm Kustomize Docker MISP Cortex Wazuh Security Onion Suricata Python fastAPI Flask BASH REST APIs Celery Redis LangGraph RAG SOAR Incident Response Threat Intelligence

SOC Analyst (part-time)

MB Tech

Oct 2024 - Jun 2026 (1 year 8 months)

Operated and maintained open-source SIEM and network detection stack, including self-hosted Splunk for log onboarding and dashboards. Monitored containerized workloads, triaged alerts, performed endpoint forensics and malware analysis, and escalated incidents.

SIEM Splunk Wazuh Suricata Log Management Incident Response Malware Analysis Container Security

SOC & Network Security Intern

Attijari Bank

Jul 2025 - Aug 2025 (1 month)

Deployed SOC toolstack (Wazuh, Suricata, TheHive, Cortex, MISP) on bank infrastructure and integrated with SD-WAN network. Designed SD-WAN topology for 6 branch sites and wrote detection rules aligned with PCI-DSS.

Wazuh Suricata Cortex MISP SD WAN Network Security PCI DSS Detection Engineering

Penetration Testing Intern

MB Tech

Jul 2024 - Aug 2024 (1 month)

Conducted internal network penetration tests, web application testing against OWASP Top 10, and social engineering campaigns. Delivered reports with CVSS-scored findings and remediation steps.

Penetration Testing Nmap Burp suite OWASP Top 10 Social Engineering CVSS Vulnerability Assessment Network Security