Ramy Tarek Ahmed

Incident Response Assistant ManagerFull Time

Threat Hunting Team LeaderFull Time

• Job Details: Acting as a threat hunting and analysts team leader in a 24x7 Cyber Security Operations Center (CSOC) environment.  Responsible for working as a tier-2 analyst in terms of investigating the alarms and assisting the tier-1 analysts.  Conducting weekly threat hunting for suspicious and anomalous activities based on data alerts or data outputs from various toolsets in terms of data-based and attack-based approaches.  Proactively driving hunting and analysis on behalf of multiple clients.  Leveraging internal and external resources to research threats, vulnerabilities, and intelligence on various attackers and attack infrastructure.  Working with the Threat Intelligence feeds and solutions to identify threats, develop or recommend countermeasures, and perform advanced network and host analysis in the event of a compromise.  Implementing attack based and digital forensics techniques using the available technologies to hunt for threats in specific customer environments, based on available threat intelligence reports and knowledge of the attackers TTPs.  Analyzing malicious campaigns and zero-day vulnerabilities and dissecting attacks targeting the enterprise.  Delivering threat hunting reports to management in business terms.  Analyzing network traffic, IDS/IPS/EDR/DLP events, packet capture, firewall logs, etc...  Performing advanced assessment, network, and host analysis in the event of a compromise.  Assisting in fine tuning the SIEM use cases and creating new ones.  Assisting in the incident response activities.  Assisting in reviewing policies and settings of different security solutions.  Analyzing malicious campaigns and zero-day vulnerabilities.  Dissecting attacks and evaluating the effectiveness of the security technologies and devices and creating use cases accordingly.  Leading the investigation and the response efforts into the advanced attacks and the critical incidents.  Performing Root Cause Analysis of security incidents.