SOC Analyst | Blue Team | DFIR
Mohamed Sabry
I investigate alerts, extract IOCs, map adversary behavior to MITRE ATT&CK, and build practical blue-team labs and tools for production-ready security operations.
17K+log lines analyzed
308detection rules
57+IOCs extracted
soc-console
$
status: available for SOC analyst roles
About
Blue-team operator with a builder's mindset.
SOC Tier 1 Analyst with hands-on experience in SIEM operations, alert triage, incident response, IOC extraction, and log analysis across Splunk, ELK, Wazuh, and Microsoft Sentinel environments.
Practical DFIR background through structured investigations, CTF labs, disk and memory forensics, PCAP analysis, evidence handling, and incident report writing. Founder of Zero2Aura, delivering cybersecurity training and software services.
Experience
Current work and field practice.
Cybersecurity Instructor & Founder
Zero2Aura
Deliver SOC fundamentals training, build practical investigation exercises, and run a cybersecurity training and software services company covering courses, penetration testing, and web development.
Digital Forensics Investigator Intern
Digital Egypt Pioneers Initiative (DEPI)
Practice network, disk, and memory forensics with Wireshark, Tshark, Autopsy, FTK Imager, and Volatility while applying evidence handling and chain-of-custody standards.
Incident Response Analyst Intern
Digital Egypt Pioneers Initiative (DEPI)
Investigated alerts and log data, identified IOCs, executed triage and containment workflows, and documented findings in SOC-style incident reports.
Cybersecurity & Penetration Testing Training
British University
Completed intensive on-site training covering Linux, Windows administration, networking, reconnaissance, vulnerability identification, and live lab attack-defense scenarios.
Core Competencies
Tools and skills mapped to real SOC workflows.
SIEM & Monitoring
SplunkELKWazuh 4.14.4Microsoft SentinelAlert TriageCorrelation Rules
Incident Response
IOC ExtractionContainmentEscalationDocumentationTimeline BuildingReport Writing
Threat & Forensics
MITRE ATT&CKSTIX 2.1SigmaAutopsyFTK ImagerVolatilityWireshark
Engineering
PythonBashJavaLinuxGit/GitHubRegexThreatScope
Projects
Evidence of hands-on detection and investigation.
SOC Lab - Automated Threat Detection & Incident Response
Real-world attack simulation covering SSH brute force, PowerShell fileless execution, and Linux privilege escalation with full detection and response workflow.
- Detected 400+ security events with Wazuh SIEM.
- Analyzed 17,000+ log lines using ThreatScope.
- Mapped findings to 12 MITRE ATT&CK techniques across 6 tactics.
ThreatScope
Open-source Python log intelligence and threat detection engine with STIX IOC export, Sigma support, GUI and CLI modes, and 308 detection rules.
View repositoryMalware Disk Image Investigation
Static DFIR case identifying filename spoofing, ISO-based MOTW bypass, layered obfuscation, Windows Script Host execution, and registry persistence indicators.
Credentials
Cybersecurity training and professional certificates.
Google Cybersecurity Professional Certificate
Microsoft Cybersecurity Analyst Professional Certificate
Cisco Security Operations Center
SOC Level 1 - TryHackMe
Incident Handling & Response - ITI MOOC
Junior Cybersecurity Analyst - Cisco NetAcad
CCNA 7 - Cisco NetAcad
Threat Intelligence 101 with Cisco Talos
Certified in Cybersecurity - CC (ISC2)
Contact
Ready to strengthen your SOC pipeline?
Open to SOC Analyst roles, blue-team collaborations, cybersecurity instruction, and practical detection engineering projects.