wassim ben guirat

I’m a results-driven Network & System Security Engineer with 4+ years of experience in SOC operations, IT infrastructure security, and team leadership. I’m an active member of CERT Tunisia, and I build reliable detection and response workflows that turn security signals into actionable outcomes.

In SOC L1/L2 roles, I monitored and correlated security events across multiple SIEM platforms (Microsoft Sentinel, IBM QRadar, Splunk, LogRhythm, FortiSIEM, OSSIM AlienVault, Security Onion) and tuned correlation rules to reduce false positives. I investigated phishing campaigns, suspicious URLs, unauthorized access attempts, and malware alerts—then executed initial containment like account disabling, host isolation, and firewall rule modifications—while documenting incident timelines, IOCs, and root cause analysis.

I also strengthen threat intelligence and adversary understanding through OSINT and proactive hunting. I performed dark web monitoring with Tor, Ahmia, and Recon-ng, tracked leaked credentials, and delivered weekly intelligence reports to help clients reset compromised credentials and mitigate risks before exploitation. When handling TA505 ransomware, I led post-breach reconstruction, contained the threat within 45 minutes by isolating hosts and blocking C2 domains, and performed reverse engineering with IDA Free, Ghidra, x64dbg, and dnSpy—then documented YARA rules for detection and shared IOCs with CERT Tunisia.

Beyond detection, I secure the environment end-to-end through hardening, governance, and service tooling. As Head of IT Department, I designed backup and disaster recovery strategies using Veeam Backup & Replication and Duplicati, hardened Windows/Linux systems using CIS benchmarks and controls like fail2ban, AppArmor, and iptables, deployed GLPI with RBAC/LDAP and audit logging, managed Microsoft 365 security (Conditional Access, MFA enforcement, Defender for Office 365, and DLP), and improved monitoring with VLAN segmentation and Wazuh XDR (FIM, log analysis, real-time alerts). I bring the same discipline from SOC to infrastructure security: playbooks, SOPs, standardized incident response documentation, and continuous improvement.