Mohamed G.Private profile: Upwork shows its earnings only to signed-in members, so we check it every few weeks, not daily. MRR here is a rough estimate (Upwork's six-month earnings ÷ months active). Last read Nov 5, 2026.

I help security teams build, tune, and maintain detection capabilities that identify real threats faster while reducing false positives, alert noise, and analyst fatigue. I'm a Threat Detection Engineer with 5+ years of cybersecurity experience, specializing in SIEM detection engineering, security use cases, threat hunting, incident investigation, and SOC optimization across complex enterprise environments. My primary focus is turning security requirements, attacker behavior, and real-world security assessment findings into production-ready detections that provide actionable results—not just rules that look good on paper. What I Deliver 🔹Detection Engineering & SIEM Optimization: • Build, develop, deploy, and maintain SIEM detection rules and security use cases • Create detection logic using SPL, KQL, and Sigma • Develop and optimize correlation searches aligned with MITRE ATT&CK • Test and validate detections against real-world attack scenarios • Continuously tune detections to improve alert fidelity and reduce false positives • Work with Splunk, Microsoft Sentinel, IBM QRadar, and FortiSIEM 🔹Red Team & Penetration Test Detection Engineering: • Analyze Red Team and penetration testing reports to understand attack paths, techniques, tools, and activities performed during security assessments • Translate identified attack techniques and security gaps into actionable detection requirements • Develop and deploy detections for attack activities that were not previously detected • Validate existing detections against observed attack techniques and identify detection coverage gaps • Map attack activity to MITRE ATT&CK and strengthen detection coverage based on real-world adversary behavior • Turn penetration testing findings into measurable improvements in SIEM and SOC detection capabilities 🔹Detection-as-Code & Automation: • Support detection lifecycle management using Git and CI/CD workflows • Automate detection testing, validation, and deployment using Git, GitHub Actions, and Python • Apply engineering practices to make detection content more consistent, testable, and maintainable 🔹Threat Hunting & Investigation • Conduct hypothesis-driven threat hunting using behavioral analysis • Correlate SIEM, EDR, and network telemetry to investigate suspicious activity • Analyze attacker behavior including lateral movement, persistence, credential attacks, and other techniques • Investigate security events from initial detection through resolution 🔹EDR/XDR & Incident Response • Work with Microsoft Defender for Endpoint, CrowdStrike, and Trend Micro • Support the full incident lifecycle: triage, investigation, containment, and lessons learned • Analyze IOCs, IOAs, malware activity, and suspicious endpoint behavior 🔹Cloud & Identity Security Monitoring • Develop detections for identity-based attacks and cloud security threats • Analyze security telemetry from Azure, AWS, IAM, CloudTrail, Defender for Cloud, and Entra ID • Identify suspicious authentication, privilege, account, and access activity 🔹Security Dashboards & Visibility • Design, develop, and maintain SOC and security dashboards • Build dashboards for MTTD, MTTR, detection coverage, alert quality, incident status, and SOC visibility • Transform security telemetry into clear and actionable information for security teams How I Work I focus on real operational impact: improving detection accuracy, reducing alert noise, strengthening SOC visibility, and helping analysts respond to meaningful threats faster. I can support the full detection lifecycle—from identifying detection requirements and analyzing attacker behavior, through designing the logic, development, testing, deployment, false-positive mitigation, documentation, and ongoing maintenance. I can also take findings from Red Team and penetration testing activities and turn them into concrete detection improvements—helping security teams close the gap between "the attack was possible" and "the attack would be detected." Every detection should survive production reality, not just work in a lab. If you need someone to build or improve your detection engineering capability, turn security assessment findings into detections, tune your SIEM, develop security use cases, investigate suspicious activity, or enhance SOC visibility, I can help.