Ismail Abdul Ghafoor

Led the migration of 300+ detections to entity-based Risk-Based Alerting on Splunk ES & SOAR, cutting false positives by 97%+ and raising true positives by 80%+. Oversaw 350+ detections across Splunk, MDE, and CrowdStrike, and developed a detection CI/CD pipeline.

Led the Detect & Identify (Tier 1) function, managing daily operations and overseeing 20+ staff. Developed KPIs and performance metrics to improve response times and detection, and built relationships with external stakeholders such as the NCSC.

Led the Investigate & Respond (Tier 2) function and acted as Incident Response Coordinator. Served as Splunk SME, developed a triage platform, conducted malware analysis and reverse engineering, and created a cross-team threat intelligence workflow.

Built an SMS phishing analyser and Splunk dashboards to cluster and track campaigns. Developed automated tooling to identify phishing kits and monitor malicious sites, and analysed malware targeting customers and staff.

Worked on External Phishing and Brand Abuse functions within the Customer Protection strand.

Completed SANS SEC555: Detection Engineering and SIEM Analytics and FOR610: Reverse-Engineering Malware.

Earned Splunk Enterprise Security, Splunk Core Certified User, and Splunk Fundamentals 1 & 2 certifications.

Earned 5 Level 4 Certificates in Cyber Security from BCS.

Achieved Level 4 Cyber Security Technologist qualification from City & Guilds.

Completed CrowdStrike CST 350: Deriving Intelligence from Falcon Sandbox.