salsabil moumni

I’m an L1 SOC Analyst and cybersecurity engineer with hands-on experience in 24/7 security monitoring, alert handling, and initial triage of security events using SIEM and XDR platforms. I focus on assessing alert severity, documenting findings in ticketing systems, and escalating issues to Tier 2 teams using SOC runbooks and operational procedures.

At DefensyLab, I performed initial alert triage and handled 20–30 daily security alerts, investigating IOCs like malicious IPs, suspicious process trees, and phishing artifacts. I mapped confirmed threats to MITRE ATT&CK TTPs with full escalation documentation, and I helped reduce false positives by tuning KQL analytic rules based on recurring noise patterns.

I also built and automated security workflows—designing and deploying an MDR/SOC platform with Laravel, Vue.js, and Wazuh SIEM/XDR, and creating analyst dashboards for real-time log analysis and incident tracking. Through my security projects, I authored 15+ custom Azure Sentinel (KQL) detection rules and automated enrichment, IOC lookup, and containment using a SOAR pipeline (Wazuh, Shuffle, TheHive, Cortex).

I’m particularly motivated by improving detections and response capabilities. From penetration testing with tools like Nmap, Metasploit, Nessus, and SQLmap to AI-assisted phishing detection using Splunk, n8n, and a GPT API, I bring a practical, continuous-learning mindset—backed by SOC-focused certifications and my AZ-500 work in progress.