SOC Analyst & Detection Engineer · Threat Hunting · Detection Engineering · Cloud Security

Cybersecurity Engineering graduate with a non-traditional path into the field. I build hands-on detection labs that simulate real adversary behavior, engineer the detections to catch it, and document the whole thing like a working SOC. I bring an entrepreneur's discipline and a detection engineer's precision to everything I do.

My road to cybersecurity hasn't been a straight line, and that's my edge. I immigrated to the U.S. from Iraq and restarted my education from where I left off, an early lesson in resilience. To put myself through college I built an online health and fitness coaching business that grew to nearly 200K followers across TikTok and Instagram, then founded a private transportation company in the DC area now running contracts with law firms, NGOs, and political offices behind a team of 8 full-time drivers.

Running those businesses taught me how to think under pressure, manage people, and allocate time and resources when it actually matters. Cybersecurity is where my heart has always been, and I'm bringing that same drive and problem-solving mindset into threat detection, threat hunting, and cloud security.

• 🔭 Currently building an APT29 (SolarWinds actor) adversary-emulation and detection-engineering capstone in Splunk
• 🌱 Focused on blue team security: SOC Analyst / Detection Engineer roles
• 💬 Always happy to connect with other people who love this work — reach out on LinkedIn

SIEM & Detection

EDR, Endpoint & Threat Detection

Adversary Emulation & Offensive

Cloud & DevSecOps

Programming & Scripting

Frameworks & Compliance

Proactive, hypothesis-driven threat hunting in Microsoft Sentinel. Three hunts mapped to MITRE ATT&CK, two Sigma rules, and a live analytics rule that fires a real incident. The centerpiece is a cloud identity account-takeover hunt modeled on the technique behind the 2023 MGM and Caesars breaches. Sentinel KQL Sigma MITRE ATT&CK Detection-as-Code 🔗 View repository →

AI-augmented detection lab across the full identity kill chain: simulate the attack, ingest telemetry, write the detection, score the alert with machine learning, and triage it with a local LLM. Detects Kerberoasting, DCSync, Pass-the-Hash, and LSASS dumping. Elastic Sysmon Atomic Red Team Isolation Forest Llama 3.2 🔗 View repository →

End-to-end SOC detection and incident response against a live credential-theft attack. Disable defenses, run a Sliver C2 implant, dump LSASS, then detect and triage it entirely through EDR telemetry. LimaCharlie EDR Sliver C2 Incident Response VirusTotal 🔗 View repository →

CI/CD pipeline that scans container images with Trivy, automatically maps every finding to the NIST 800-171 control it violates, and blocks the build over a risk threshold. A base-image fix cut build-blocking findings by 72%. Docker GitHub Actions Trivy Terraform NIST 800-171 🔗 View repository →

Self-hosted network-wide DNS filtering on DietPi and VirtualBox, plus the insight that the query log is a passive DNS threat-hunting source you can cross-reference against IOC feeds. Pi-hole DNS DietPi Threat Hunting 🔗 View repository →

Emulating APT29 (the SolarWinds actor) end to end in Splunk, then engineering and CI-testing the detections to catch it, with automated response, threat-intel enrichment, and a full incident response report. Splunk SPL Adversary Emulation SOAR Detection-as-Code 🔗 Repository coming soon

B.S. in Cybersecurity Engineering — George Mason University · December 2024

• 🇺🇸 English — Fluent
• 🟩 Kurdish — Fluent
• 🟢 Arabic — Fluent