About
SOC Analyst and Cybersecurity Engineer with 1+ year of hands-on experience monitoring, detecting, and responding to security threats in a 24x7 Security Operations Center, backed by a prior security internship. Skilled in SIEM-based real-time monitoring (FortiSIEM, Splunk), SLA-driven alert triage and escalation, custom regex parser development, threat-intelligence enrichment, and end-to-end incident response following the NIST IR lifecycle. Experienced investigating phishing (T1566), brute-force (T1110), and unauthorized-access (T1078) attacks and mapping adversary TTPs to the MITRE ATT&CK framework. Google Cybersecurity and TryHackMe SOC Level 1 certified, with CEH in progress.
Skills & Expertise (41)
Work Experience
SOC L1 — Cyber Security Engineer
Techowl Infosec Pvt. Ltd
Dec 2025 - Jun 2026
Monitored and triaged 100+ security alerts daily in a 24x7 SOC using FortiSIEM and Splunk, performing event correlation, log analysis, and severity-based escalation within defined SLAs for a banking client. Investigated phishing (T1566), brute-force (T1110), unauthorized-access (T1078), and account-compromise incidents by analyzing Windows Event Logs, Linux logs, firewall logs, and network traffic, enabling accurate classification and escalation. Developed and maintained regex-based parsers and onboarded multiple log sources into FortiSIEM, improving log normalization and expanding centralized monitoring coverage. Created and tuned SIEM correlation rules and detection use cases to raise detection accuracy and reduce false positives, cutting analyst time spent on alert noise. Automated IOC enrichment by integrating VirusTotal and AbuseIPDB APIs into alert workflows, reducing manual investigation effort and accelerating triage. Conducted endpoint investigations and containment with Microsoft Defender for Endpoint, CrowdStrike Falcon, and SentinelOne — analyzing malicious processes, isolating hosts, and supporting remediation. Mapped adversary TTPs to MITRE ATT&CK and supported root cause analysis, incident reporting, and SLA- and audit-compliant documentation.
SOC Analyst Intern
ShadowFox
Mar 2024 - Nov 2025
Built an automated threat-intelligence enrichment pipeline integrating VirusTotal and AbuseIPDB APIs with SIEM alert workflows using Python and REST APIs. Automated IOC validation for suspicious IP addresses and file hashes, reducing manual investigation effort and improving analyst triage efficiency. Streamlined SOC triage through API-driven enrichment lookups, accelerating alert handling and reducing repetitive manual lookups. Built an autonomous phishing-detection agent with n8n and Google Gemini 2.5 that monitors inbound emails via IMAP and runs AI-driven analysis to flag phishing threats in real time. Delivered automated, real-time SOC alerts achieving ~95% detection accuracy with alert speeds under 20 seconds, cutting analyst workload while processing thousands of emails daily. Orchestrated end-to-end email ingestion, LLM-based classification, and alert routing using custom JavaScript and REST API integrations, enabling up to 47x faster triage than manual review.
Education
Bachelor of Commerce (Computer Applications) - Kakatiya University
2022 - 2025 · Afghanistan
Intermediate — MEC (Mathematics, Economics, Commerce) - T/S Model School & Junior College
2020 - 2022 · Afghanistan
Certifications
TryHackMe SOC Level 1
· 2025
TryHackMe Security Engineer
· 2025
Google Cybersecurity Professional Certificate
Google / Coursera · 2024
Introduction to Cybersecurity
Cisco Networking Academy · 2024
Interested in this developer?
Profile Score Breakdown
Profile Overview
Availability Details
Visa Status
Citizen
Relocation
Not Open to Relocation
Skills (41)
Click a skill to find developers with the same skill
