Ahmed R.

• Conducte complex incident response investigations for enterprise customers, from initial triage and evidence collection through containment and remediation. • Performe advanced memory forensics to identify APT activity, file-less malware, malicious processes, and evasive techniques. • Conducte host and network forensic analysis to establish incident scope, identify affected systems, reconstruct attacker activity, and determine root cause. • Investigate malware and suspicious artifacts in support of incident response and threat investigations. • Correlate endpoint, memory, network, and system evidence to reconstruct detailed incident timelines and attacker activity. • Produce detailed technical investigation reports documenting findings, indicators, attack techniques, impact, and remediation recommendations. • Communicate technical findings and response recommendations to customer security teams and stakeholders.