Securing networks.
Hunting threats.
I build and protect enterprise network environments, combining hands-on network security experience with a growing focus on SOC operations, threat detection and incident response.
About me
Enterprise infrastructure experience with a security-first mindset and a practical, hands-on approach to continuous learning.
Network & security foundation
Experienced in supporting enterprise banking networks, firewall environments, secure connectivity and infrastructure change activities. Focused on stability, visibility and controlled change.
Growing into Blue Team
Building practical defensive skills through SOC-focused labs, packet analysis, endpoint telemetry, SIEM searches and detection engineering exercises.
Technical expertise
A blend of enterprise network engineering, security platforms and defensive analysis.
Network security
Firewall administration, policy reviews, VPN, NAT, ACLs, segmentation and secure connectivity.
Security monitoring
Log review, alert triage concepts, IOC investigation, event correlation and operational monitoring.
Network engineering
Routing, switching, VLANs, LAN/WAN, SD-WAN, OSPF, BGP, EIGRP and troubleshooting.
Packet analysis
Wireshark, TShark, TCP/IP analysis, traffic baselining and suspicious connection investigation.
Detection & response
Snort fundamentals, Sysmon telemetry, Sigma/YARA learning and incident-handling workflows.
Security platforms
Palo Alto, Cisco security, Forcepoint, Fidelis NDR, Imperva WAF and endpoint protection technologies.
Enterprise network topology
A simplified, illustrative enterprise banking network: branch connectivity, SD-WAN, security inspection and protected services. No real internal addresses or confidential topology are shown.
Suspicious traffic attempt
Illustrative sequence: external scan → edge inspection → policy match → alert raised for analyst review.
Detect, investigate, respond
Correlate firewall and endpoint telemetry, validate the IOC, scope affected assets and document the response.
Professional experience
Enterprise IT and security operations in demanding environments.
Senior Network & Network Security Engineer
Kuwait International Bank · Kuwait
Supporting enterprise banking network and security infrastructure, firewall operations, branch connectivity, SD-WAN activities, security platforms, change requests and day-to-day service continuity.
Network Engineer
Government sector · Kuwait
Network operations, infrastructure support and enterprise connectivity.
Platforms & tools
Progress bars are a visual self-assessment, not formal proficiency scores.
Blue Team lab notes
Hands-on practice focused on understanding telemetry, identifying suspicious activity and documenting findings.
Investigating network traffic
Reviewing PCAP files, identifying connection patterns, understanding TCP handshakes and filtering suspicious traffic.
$ tcp.flags.syn == 1 && tcp.flags.ack == 0
[+] Inspect → correlate → document
Searching security events
Practising searches across Windows and network telemetry, looking for unusual authentication and endpoint activity.
| stats count by src_ip, user
[+] Review patterns and context
Snort detection practice
Learning alert interpretation, rule structure and validation against controlled lab traffic and PCAP samples.
[+] Validate alert → inspect packet
Windows event investigation
Exploring Sysmon and Windows event logs to understand process creation, network connections and suspicious execution chains.
Event ID 3 — Network connection
[+] Build timeline and assess
Network security & SOC case studies
Practical work samples that connect enterprise networking, security controls and Blue Team investigation methods. Lab scenarios are clearly identified; no confidential employer data is included.
Secure branch connectivity & SD-WAN
High-level case study of multi-branch connectivity: resilient WAN paths, segmentation, secure traffic inspection and centralized visibility across distributed sites.
Focus areas
SD-WAN concepts · routing · VLAN segmentation · firewall policy · availability monitoring
[02] Validate path and policy
[03] Monitor health and document change
Firewall policy review & change validation
A structured workflow for reviewing access requests, checking source/destination/service scope, assessing exposure and validating connectivity after an approved change.
Focus areas
Least privilege · NAT · ACLs · rule review · change control · logging
[02] Review rule scope and risk
[03] Test, monitor and record
Port scan detection with packet analysis
Lab investigation using a PCAP to identify repeated connection attempts, distinguish scan patterns from normal traffic and review related IDS alerts.
Tools
Wireshark · TShark · Snort
$ snort -r scan-lab.pcap -A alert_fast
[+] Identify source, targets and timeline
Repeated failed logins investigation
Simulated authentication-alert triage: group failed logins by account and source, establish the time window, compare successful logins and decide what evidence is needed next.
Tools
Splunk · Windows Security logs · Event ID 4625
| stats count by user, src_ip
[+] Correlate and assess severity
Suspicious process & network activity
Endpoint-focused lab review using process creation and network connection telemetry to build an event timeline and identify activity that needs further investigation.
Tools
Sysmon · Windows Event Logs · PowerShell
Event ID 3 — Network connection
[+] Build timeline and preserve evidence
From alert to incident report
A repeatable analyst workflow covering alert validation, evidence collection, scoping, containment recommendations, escalation and clear handover notes.
Focus areas
MITRE ATT&CK mapping · evidence handling · severity · escalation · lessons learned
[02] Contain or escalate
[03] Document and close
Portfolio note: Case studies 03–06 are representative lab exercises and investigation workflows, not claims of live incident response at an employer. Case studies 01–02 describe professional areas at a high level. All examples are sanitized and contain no real internal IPs, customer information or confidential configurations.
Threat monitoring & alert triage
A simulated SOC view showing how telemetry, detections and analyst triage fit together. Values and alerts below are illustrative—not live monitoring data.
| TIME | DETECTION | SEVERITY | STATE |
|---|---|---|---|
| 10:42:08 | Repeated auth failures | HIGH | Review |
| 10:39:51 | Unusual DNS pattern | MED | Open |
| 10:35:17 | IOC reputation match | HIGH | Enrich |
| 10:31:44 | Policy deny event | LOW | Closed |
Illustrative event stream only. No real customer, employer or production telemetry.
Attack chain & defensive controls
Understand the adversary sequence, then map visibility and controls to each stage. The highlighted stage pulses to show the simulated progression.
Firewall policy, IPS signatures, URL filtering, geo/IP reputation and segmentation.
NetFlow, DNS, proxy logs, NDR analytics and packet capture investigation.
EDR alerts, Sysmon events, process lineage, persistence checks and isolation workflow.
SIEM correlation, enrichment, case management, escalation and evidence preservation.
Layered network security
How common security technologies work together across the enterprise environment and how a SOC analyst can use their telemetry.
Telemetry flows to monitoring platforms; enforcement and response actions follow approved operational procedures.
Watch the traffic. Stop the threat.
Animated conceptual scenarios showing how malicious traffic can be detected at the perimeter and how defenders use telemetry to investigate.
[PASS] IPS signature inspection
[INFO] IOC enrichment requested
[PASS] SIEM correlation created
[PASS] Analyst case opened
Inside an analyst investigation
From first alert to closure: practical steps and evidence sources used in a structured defensive investigation.
Check detection logic, timestamp, affected user or host, source logs and false-positive context.
Correlate firewall, DNS, proxy, endpoint and identity events into one investigation timeline.
Escalate through approved procedures, preserve evidence and record findings, impact and actions.
Network operations in motion
Network engineering and security operations meet at availability, performance, change control and continuous visibility.
Conceptual device indicators only; no real infrastructure status is being queried.
✓ Risk and dependency review
✓ Peer review / approval
✓ Implementation and validation
◷ Monitoring and rollback readiness
✓ Closure and documentation
From alert to action
A structured investigation mindset: validate the signal, establish context, scope impact and record the outcome.
Investigation checklist
Confirm the alert source and timestamp. Correlate identity, endpoint and network evidence. Check known-good baselines. Determine scope and business impact. Escalate or contain through approved procedures. Preserve evidence and document findings.
[+] Evidence collected
[+] Timeline created
[!] Scope validation required
$
Certifications & development
Building on a strong networking foundation while progressing toward dedicated security operations work.
Networking credentials
CCNA · CCNP · CCNP Security
MCSA · MCSE
Professional networking and systems credentials.
TryHackMe — Blue Team
SEC0 · SEC1 · SAL1
Defensive security learning, SOC-focused labs, packet analysis, SIEM fundamentals and incident handling practice.
Security certification
CompTIA Security+
Academic development
BSc (Hons) Cybersecurity
University of Lancashire — in progress.
Platforms I work with
Representative technologies from network and security operations experience, alongside tools used in practical defensive learning.
Network & perimeter
Cisco ASA · Cisco FTD / FMC · Palo Alto · Forcepoint NGFW · VPN · NAT / PAT · ACLs
Detection & visibility
Fidelis NDR · Cisco IPS / Firepower · Darktrace exposure · Netscout Arbor · IOC review
Application & email security
Imperva WAF · Proofpoint · Mailsweeper · Forcepoint Proxy · Blue Coat Proxy
Authentication & endpoint
RSA Authentication Manager / MFA · Trellix endpoint protection · Sysmon learning
SIEM & analytics
Splunk · QRadar (foundational exposure) · ELK · Kibana · OpManager
Analysis toolkit
Wireshark · TShark · Snort · PowerShell · CyberChef · Hashcat · YARA / Sigma learning