Detection engineering · Incident response & DFIR · Threat hunting
3+ years in a managed SOC. I build the detection, then answer for what it catches.
- Cyber Security Engineer at Global IT Vision (Tunis) since November 2023. I commission, tune and optimise client detection platforms - Darktrace NDR, LogRhythm SIEM, CrowdStrike Falcon XDR - and, as the L2 analyst, investigate what they escalate: attack reconstruction, root cause, containment and prioritised remediation under NIST SP 800-61.
- Built a ten-component SOC for my engineering degree and put a stopwatch on it: mean time to detect under one minute.
- 18 certifications: INE eCIR, eCTHP, eCDFP, eEDA, eJPT · CrowdStrike CCFA · EC-Council CEH, CSA · LogRhythm LRSA, LRPA · Darktrace · Red Hat RHCSA. Top 1% on TryHackMe.
- Based in Ariana, Tunisia (CET). Open to remote roles or relocation - Europe, Canada, the Gulf.
- Arabic (native) · French (fluent) · English (fluent).
| Project | What it shows | |
|---|---|---|
| 🛡️ | SOC aligned with NIST SP 800-61 | Wazuh, Suricata, CrowdStrike, Palo Alto, TheHive/Cortex/MISP, n8n - two MITRE ATT&CK attacks detected, correlated and escalated to an analyst in under a minute |
| 🕵️ | APT34 (OilRig) threat profile | Tradecraft across the kill chain, three malware families, DNS-tunnelling C2, detections and D3FEND countermeasures |
| 🧬 | Malware analysis - Cerber | Static and dynamic analysis of Cerber ransomware in an isolated lab, turned into detection indicators |
| 💥 | Penetration test - Metasploitable 2 | 5 vulnerabilities exploited end to end, with a risk matrix and prioritised remediation |
| 🌐 | Web application security (OWASP) | Pentest, SAST (Flawfinder, Bandit), DAST (ZAP, Nuclei) and a STRIDE threat model |
| 🔗 | Enterprise VPN-MPLS network | MPLS L3VPN with VRF isolation, MP-BGP, a redundant LAN (HSRP) and AAA/RADIUS, built in GNS3 |
Portfolio: rayengader.github.io - a bilingual site with an interactive replay of the SOC's attack scenarios.
Also: an end-to-end phishing simulation (Pwn & Patch, 2024) · a cybersecurity training platform on Odoo (DEFENSYLAB, 2023) · automated DNS/IP blocking from threat-intelligence feeds (Python + PostgreSQL) · AES, RSA and ECC implemented from the specifications.
Detection & response
Frameworks
Systems & automation
Hiring for a SOC, detection engineering or incident response team? Let's talk - rayengader9@gmail.com