Sameel A.

I am a cybersecurity specialist with expertise in SIEM engineering, EDR deployment, SOC operations, and security automation. I deploy and tune Splunk, QRadar, Elastic, Wazuh, LogScale, NG SIEM, CrowdStrike, and SentinelOne, write the detection rules that go on top, and automate the triage so alerts turn into answers instead of backlog. Five plus years in live security operations, including MSSP environments serving clients across the globe. SIEM ENGINEERING & DEPLOYMENT - Splunk, IBM QRadar, Elastic SIEM, CrowdStrike NG SIEM and LogScale, Wazuh - Platform setup, sizing, and log source onboarding - Parsers, custom detection rules, correlation searches, dashboards - SIEM to SIEM migrations EDR & XDR - CrowdStrike Falcon, SentinelOne, Microsoft Defender, Darktrace - Agent rollout and policy tuning - Threat hunting mapped to MITRE ATT&CK SOC OPERATIONS & INCIDENT RESPONSE - Alert triage through containment and root cause - Alert tuning and gap analysis to cut false positives - Digital forensics with Volatility, Autopsy, Wireshark - Malware analysis to build detection signatures SOAR & AUTOMATION - Playbooks in Splunk SOAR (Phantom), IBM QRadar SOAR (Resilient), Cortex XSOAR, Cortex XSIAM, n8n, Tines - Python, PowerShell, and Bash for the glue nobody sells a product for - Recent build cut handling time on repetitive alerts by around 60 percent AI FOR SECURITY OPERATIONS - LLM agents that do the first pass on alerts and draft investigation notes - Automated CVE advisory generation from vendor feeds - STIX 2.1 threat intel pipelines feeding OpenCTI VULNERABILITY ASSESSMENT & COMPLIANCE - Vulnerability assessment with Rapid7 Nexpose and Nessus - SOC 2 and ISO 27001 control mapping and evidence collection I ask what your detection gaps actually are before recommending anything. You get working content in your environment and documentation that outlives the contract. Message me with what you are running and what is breaking. Happy to discuss and jump on a quick call