SOC Analyst & Security EngineerKarachi, Pakistan
I keep security monitoring trustworthy, from the log source and the parser to the alert someone has to act on, and I work the incidents that come out the other end.
In progressCurrently working on: IBM QRadar migration from AWS to GCP
Security monitoring is a pipeline. An alert is only as good as every step before it, so that is where most of my work happens.
Identified 190 unintegrated assets in a client environment and remediated their log source integrations.
The auditCorrected parsers and DSM mappings for 50+ assets stuck in SIM Generic. Unknown events down 80%.
Same audit, separate resultTraced an hourly QRadar crash to expired certificates. Now moving a QRadar deployment from AWS to GCP.
The migrationPivoted from one quarantined email to a 90-day, multi-domain phishing campaign.
The phishing caseContained C2 and crypto-mining on production servers that could not go offline.
The server caseA migration still in motion and two incidents I helped work. Each one is written up with what I did, what I did not, and what I learned.
A cloud-to-cloud migration of a production IBM QRadar deployment: destination preparation, configuration restore, historical Ariel data transfer, collector connectivity, licensing, and cutover dependencies.
A quarantined email passed SPF/DKIM and sandbox detonation and carried no links or attachments. Pivoting on it uncovered a 90-day, multi-domain reply-bait campaign.
Internet-exposed production servers at 100% CPU, with isolation ruled out by uptime requirements. Baselining against a known-good host exposed masquerading malware; a default-deny egress firewall cut C2 and XMRig mining traffic.
I like understanding what the error message leaves out. When something breaks, I work down until I reach the layer where the problem actually lives, and I keep in mind what else moves if I change it.
From web development into infrastructure, then into the SOC and security engineering. That route is why I keep asking what the system underneath is doing.
QRadar administration and audits, log source integration, incident response, VMware ESXi, and the migration work.
Alert triage across SIEM, XDR, NDR and EDR platforms, phishing investigation, WAF log review, and IOC curation in MISP.
Network design support, an ISO 27001 control review, vulnerability scanning, and SIEM exposure.
Django and MySQL web applications. Still useful whenever a security product turns out to be a web app with problems.
If you are hiring for SOC, SIEM, or security engineering work, or you just want to compare notes on a stubborn QRadar problem, I would like to hear from you.