Zain Ali

I’m a Senior Security Engineer who built a Security Operations Center (SOC) from the ground up, scaling maturity from 1 to maturity 3 with automated processes and workflows. I also lead brand reputation management work with threat intelligence providers to resolve domain reputation issues and whitelist legitimate domains.

I design and implement SIEM capabilities end-to-end, including building Splunk SIEM from scratch with data ingestion, detection rules (correlation searches), and dashboards. I’ve also implemented risk-based alerting (RBA) to correlate events, reduce alert fatigue, and improve threat detection efficiency, while fine-tuning SIEM rules to lower noise and false positives. In parallel, I administer LogRhythm and have used LogRhythm threat detection with AI Engine and LogRhythm Custom MPE Rules using regular expressions.

I engineer vulnerability management programs from the ground up, setting up vulnerability scanning, risk prioritization, and remediation processes aligned to security policy and risk posture. I deploy Endpoint Detection and Remediation (EDR) to increase visibility, strengthen detection, and improve incident response, and I develop incident response playbooks and runbooks to standardize investigations. I also work across Zero trust principles and conditional access policies, and enhance data security with Microsoft 365 DLP policies including tagging and alerting.

I’m hands-on with governance and readiness: I led the evaluation, selection, and implementation of an enterprise email security solution, and I manage the approval lifecycle for AI applications and browser extensions to mitigate internal AI risks. I’ve mentored junior SOC analysts and engineers, run purple team exercises with reporting, and strengthened SOC procedures through continuous improvement.