Ali Fathi Email & Phone Number

San Diego, Ca, Us

IT Security SOC supervisor (contract)ColdMatter, Philippine October/2021- October/2023• Provide guidance on bundling and maturing information security programsspecifically threat hunting programs, responding to, and remediatingcomputer security incidents.Utilizing proofpoint SOAR: Created and maintained playbook for incidentresponse.· The incident response playbook triggers when a malware signature matches aknown threat. It isolates the affected system, collects forensic data, and notifies thesecurity team for analysis and remediation.Configured Proofpoint SOAR to pull threat indicators from available threatintelligence platform and enrich alerts with contextual information.· I helped to create custom workflows utilizing poofpoint SOAR for clients tomature IR. / Threat hunting program for clients.• Make sure digital forensic protocol to ensure evidence integrity. Documentfindings, timestamps, and chain of custody.• Snort and Nmap to scan a target system to detect unexpected orunauthorized services running on non-standard ports.• Conducted regular security and vulnerability assessments.

• Develop curriculum and training materials as well as creating goals and objectives and lesson plans for; CompTIA Security +, Network + • Designing training programmers appropriate to the skills needed. • Developing an appropriate mix of formal and informal development activities• Ensuring the learning environment and resources support learner needs • Designing course materials and other documents such as handouts, manuals and exercises;

Atlanta, Ga, Us

• Act as a trusted advisor to clients, providing security insights andrecommendations to all onboarding clients.• Define roles and responsibilities for the incident response team (IRT).• Established communication channels and escalation procedures.• Correlate events across different data sources (logs, network traffic) intoSecureWorks’s portal. And assisted clients in developing incident respondplaybook.• In Splunk create a Splunk dashboard that displays failed login attempts,successful privilege escalations, and data exfiltration utilizing Splunk tomonitor security events in real time features Strengthened incidentresponse capabilities through continuous training and simulation drills.• Splunk Monitor data flow and troubleshoot any integration issuespromptly.• Utilized charting tools (Splunk’s built-in visualizations or customJavaScript libraries) to display trends, anomalies, and patterns.for clients

Dhahran, Sa

Introduced the use of security metrics to mitigate vulnerabilities, assessed new project costs and benefits, coordinated Cyber Hunting exercises, built, and reviewed use cases, and incorporated these into the company's response process for real-time alerting.

Reston, Virginia, Us

IR: Utilize variety of tools and analysis techniques to determine if issues exist, included but not limited to anomalous traffic identification (odd encapsulation of traffic or unexplained encrypted tunnels, identification of gaps in System and Security Logs, Review of unexplained changes in system Configurations) Digital Forensics: Data retrieval, retrieving information from computers and other types of data storage devices. Data recovery, legitimate password recovery, assist with obscure troubleshooting, provide forensic readiness input/feedback. Overall network and system behavioral analysis, included but not limited to End-points and proxy packet analysis, behavioral monitoring of encrypted traffic to detect further potential unauthorized intrusion.Triage: Identifying and analyzing the effects of the Malware, with all available information at hand contain malicious behavior stopping it from spreading and determine appropriate remediation action to isolate and remove the Malware/APT Root causes analysis: followed by recommendations of solutions addressing the issue to ensure that future infections protections are in place.Familiar with Enterprise Data analytics, Web analytics application software Digital investigations suitesSecurity Analytics PlatformNetwork Threat Prevention PlatformsNetwork intrusion detection systemsVulnerability Management appliancesEndpoint threat detection and response solutionNetworks’ APT solution Platforms Email security, Anti-Spam appliancesSecurity Information and Event Management SandboxingWeb Debugging ToolsNetwork Packet Capturing Analyzer

Reston, Va, Us

• Interpreting, analyzing network Logs, reporting NIDS via Security information and event management (SIEM), escalating anomalies to top tier engineers in accordance with computer network directives. • Assisting in cyber security training development, developing change requests to provide usage of complex cyber security systems through enterprise environment • Work with colleagues to recognize the dynamic nature of most projects such as near term activities that can usually be well defined. Perform cyber security incident response, event analysis, investigations, and forensics.

London, Ontario, Ca

Functioned as a consultant, I reported directly to the CFO, acting as Project Coordinator for a number of varied projects. Oversight various projects and worked side by side with program managers and contract engineering team. Setup and developed electronic collaboration tools as well as planning and implementation of Cisco VoIP for all contract and agency’s offices following HIPAA as well as Department of Mental Health, County of Orange, California guidelines.

Arlington, Va, Us

-Technical/project management in the development of a corporate Emergency Broadcast Systems, responsible for management of project tasks and project timelines, worked with client to define interface and functionality requirements.-Performing as SME for Raytheon SAS Enterprise portals: e-Room, Icon, Docushare. Lotus Notes Sametime collaboration application.-In charge of configuration, installation, troubleshoot and scheduling Video Teleconferencing (VTC) for all SAS Raytheon meetings

Arlington, Va, Us

- Performed as Sr. Technical support for VPs & Executives at Raytheon RTSC HQ- Supervised and trained colleagues, including tier I and tier II support technologist. - Provided support for migration of 1000+ user accounts from Novel Netware to MS Active Directory, - Setup and configured windows 2000 file and print servers, applied hot fixes as necessary according to DoD specifications

- As an ISO-9000 certified technician,responsible for standard Level 1 Desktop Support, helping and handling desktop, hardware problems- Maintained warranty services for clients including: US Department of Labor, US Department of Health and Human Services, Prince Gorges county public schools, Northern Virginia Community College, Fredric county regional jail, and Lynchburg county public schools

Master Of Science - Ms

Bsis, Computer Netwroking