Looking for a job

soufiane taoufik

@soufianetaoufik

Message

I investigate security alerts, endpoint evidence, and identity activity across SOC environments.

United Kingdom

Message

What I'm looking for

I'm looking for security work supporting AI-enabled products and real user systems, where I can investigate alerts, develop SOC workflows, and continue building my SIEM and incident-response skills.

I've monitored managed customer environments at Abacus Group, triaging suspicious sign-ins, phishing alerts, account lockouts, and endpoint activity in Rapid7 InsightIDR.

I investigated authentication, email, and endpoint evidence using Microsoft 365, Entra ID, SentinelOne, Microsoft Defender, Proofpoint, Mimecast, and Duo MFA. I documented findings, user impact, affected accounts, and recommended next steps for escalation and case closure.

I've also built Splunk searches and dashboards for Lloyds Banking Group / GlobalLogic, and maintain a home SOC lab using Splunk, Sysmon, Windows Event Logs, KQL, Wireshark, Active Directory, and Windows endpoints.

Experience

Work history, roles, and key accomplishments

Security Operations Analyst Intern

Abacus Group

Apr 2024 - Aug 2024 (4 months)

Monitored alerts in Rapid7 InsightIDR and reviewed suspicious sign-ins, account lockouts, phishing alerts, and endpoint activity. Investigated authentication, email, and endpoint evidence using Microsoft 365, Entra ID, SentinelOne, Microsoft Defender, Proofpoint, Mimecast, and Duo MFA.

Rapid7 InsightIDR Microsoft 365 Entra ID SentinelOne Microsoft Defender ProofPoint Mimecast Duo MFA SOC Alert Triage Incident Documentation

Splunk Engineer Intern

Lloyds Banking Group / GlobalLogic

Jul 2023 - Sep 2023 (2 months)

Built and refined Splunk searches and dashboard panels to support log review and monitoring use cases. Filtered security and operational logs by fields, timestamps, sourcetypes, and hosts to make events easier to review.

Splunk Dashboard Development Log Analysis Data filtering Search Optimization

Splunk Engineer Intern

Lloyds Banking Group

Jul 2023 - Aug 2023 (1 month)

During my internship at Lloyds, I gained hands-on experience with a variety of cybersecurity technologies, including Splunk, Sentinel, and SentinelOne. One of my key accomplishments was learning how to set up and configure Splunk rules, based on the criteria defined by threat modelers. This allowed me to deepen my understanding of proactive threat detection and response.

Beyond the technical skil

Education

Degrees, certifications, and relevant coursework

Microsoft

SC-200 Microsoft Security Operations Analyst, Security Operations

Currently studying for the SC-200 Microsoft Security Operations Analyst certification, focusing on Microsoft Sentinel, Defender, incident queues, KQL, alert investigation and response workflows.