Rached Salah Email & Phone Number

Tunis, Tunisia

Tunisie

•Maintaining security solutions in Operational Condition•Deployment of security solutions•Analysis and treatment of security incidents escalated from SOC team•Incident response and collaborating with SOC team•Conducting weekly and monthly meetings with managed SOC team•Implementation of security processes•Network, IS and product audit•Analysis & Monitoring of vulnerabilities in vocalcom products•Mobile device management integration•Microsoft Intune administration•Supervise SOC activity (steering committee, reporting and monitoring).•Lead the planning, execution, and delivery of IT projects, ensuring they arecompleted on time, within budget, and meet the defined requirements•Collaborate with stakeholders to define project scope, goals, and deliverables•Monitor project progress, track key performance indicators, and provideregular status updates to stakeholders and management•Foster effective communication and collaboration between project teams,stakeholders, and management•Ensure project documentation is created and maintained, including projectcharters, requirements documents, and change requests•Lead project meetings, including kick-off meetings, progress meetings

●Audit and Healthcheck of Distributed SIEM Deployments (QRADAR)●Upgrade and Disaster Recovery●Integration and Tuning for sensitive perimeters (PDIS)●OS Hardening , Web Browsers Hardening ●Best Practice of Usage for Analysts and Integration teams●Review of Supervision Strategy and Alerting Strategy●Review and customization of unkown events●Support entities / BU in their use of security solutions●Troubleshooting and tuning of SIEM problems●Interact with vendor support teams and monitor entities' tickets resolution●Keep security solutions in operational and security condition●Monitoring (system & application)●Plan and deploy updates / upgrades (both OS and application)●Maintain documentation up to date●Perform a watch on upcoming changes in order to identify new features to be implemented●Report periodically on security KPIs for various security committees●Assist SOC investigations●Proofpoint administration ●Developping Email protection quarantine policies

●Administration of security solutions●Response to incidents reported by ( Cortex , Splunk , Microsoft Defender andazure sentinel )●Creation of workbooks and rules on azure sentinel●Handling data leak incidents with Netskope DLP●CASB administration●Setting up phishing campaigns with Terranova (Security Awareness)●Creating procedures ( prioritization , escalation ,..),●Monitoring and Investigation activities on O365 apps ( Riskysign-In ..)●Ensuring GDPR compliance best practices

Tunis, Tunisie

●Installation Qradar SIEM-Integration of different technologies●WinRM Collect Implementation●Definition of Best Practices for Custom Parsing and Custom Rules Implementation●Treatment and deployment of use cases in a Pre-Prod platform●Investigation and response on security alerts●Creation of rules on Qradar SIEM●Development of incident response playbooks●CTI activities ( Cyber Threat Intelligence)●Threat hunting activities●Internal forensics activities●Perform scans at all levels: Windows/Linux/Mac OS, database, application.●Create and manage weekly and monthly reports based on scan results

●Setting up Qradar and Splunk SIEM for different clientsConducting internall team on use case factory ( Use case development , treatment , deployment optimization and preparing use case card for each rule based on security domain services ( SDS) ).●Collection of logs from different sources, creation of rules, processing of use cases●Firewall installation and configuration (Sophos/pfsense)●Definition of Best Practices for Custom Parsing and Custom●Rules Implementation●Review and customization of unkown events

Administration D’Infrastructures Securisées

Réseaux Et Securité Informatique

Education record