Looking for a job

Mahtab Kasaie

@mahtabkasaie

SOC Team Lead at Shatel, reengineering Splunk architecture and building detection coverage across enterprise environments.

Iran

Message

What I'm looking for

I’m seeking a role in SOC leadership, security operations, Splunk engineering, detection engineering, threat hunting, incident response, DevSecOps, or security management.

At Shatel, I lead SOC operations and reengineered SIEM architecture across data ingestion, indexing, and pipeline flows to improve stability, coverage, and detection reliability.

I developed Splunk dashboards for SOC visibility and platform health, and authored correlation searches for lateral movement, privilege escalation, anomalous PowerShell usage, and persistence.

At Tapsi, I led advanced SOC operations, mentored Tier 1 analysts, and developed MITRE ATT&CK-based detections. I also automated case workflows in TheHive and integrated threat intelligence workflows.

Earlier at Taracell, I investigated incidents, performed threat hunting and forensics, and configured AlienVault SIEM. I’m expanding my DevSecOps capabilities, and my research proposal focuses on SOC automation using LLMs and AI.

Experience

Work history, roles, and key accomplishments

Current

SOC Team Lead

Current

Shatel

Oct 2025 - Present (1 year 1 month)

Lead SOC operations across enterprise environments, focusing on SIEM reliability, detection coverage, incident response, and analyst enablement. Reengineered SIEM architecture and developed Splunk tuning frameworks to reduce alert fatigue.

SOC Leadership SIEM Splunk Incident Response Detection Engineering MITRE ATT&CK Sysmon Windows Event Logs Linux Logs Network Logs Telemetry Playbooks Documentation

Delegate / Trainee

Positive Technologies

Jul 2026 - Sep 2026 (2 months)

Selected through a competitive process for a full-time offensive security program. Completed approximately 70 hands-on CTF challenges covering multiple stages of the attack lifecycle and MITRE ATT&CK tactics.

Offensive Security CTF MITRE ATT&CK Vulnerability Research

SOC Senior Expert

Tapsi

Mar 2024 - Oct 2025 (1 year 7 months)

Led advanced SOC operations including incident investigation, alert review, threat hunting, and detection tuning. Mentored Tier 1 analysts and developed MITRE ATT&CK-based detections.

SOC Operations Incident Response Threat Hunting Detection Tuning MITRE ATT&CK Mentorship Splunk Elastic The Hive Threat Intelligence Automation

SOC Tier 2 Analyst

Taracell

Oct 2023 - Mar 2024 (5 months)

Conducted incident response and forensic investigations across endpoint, network, firewall, and SIEM alerts. Performed threat hunting and root cause analysis to reduce recurring incidents.

Detection Engineering Incident Response Digital Forensics Threat Hunting Root Cause Analysis AlienVault Detection Use Cases SIEM SOC Workflows

SOC Tier 1 Analyst

Taracell

Apr 2022 - Oct 2023 (1 year 6 months)

Monitored SIEM alerts, investigated anomalies, documented evidence, and escalated confirmed incidents to senior analysts. Supported Windows hardening, firewall tasks, and dashboard development.

SIEM Monitoring Alert Triage Incident Escalation Windows Host Hardening Firewalls Dashboard Development