Reza N.-Senior IT Security Engineer · Detection & Response · Microsoft Security

• Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
• Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
• Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
• Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
• Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
• Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
• Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR

Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK

• Analyzed and assessed security alerts and reports in the IBM QRadar SIEM system, identified false positives, and detected and assessed security-relevant incidents
• Further developed and documented the alerting chain and ensured traceable escalation of critical security events according to project-specific requirements
• Independently created use case reports and alerts based on existing log data; checked the correct integration and interpretation of log files to reduce false positives
• Developed and deployed detection logic based on Sigma Rules for proactive threat detection
• Rolled out the EDR solution across the company and implemented cross-platform security policies
• Provided conceptual and technical consulting for the migration from IBM QRadar to Palo Alto Cortex XDR
• Targeted optimization of SIEM processes to improve detection quality and efficiency in security monitoring

Technologies: IBM QRadar, Palo Alto Cortex XDR, Sigma

• Designed secure infrastructure, network, and application architectures and created reference architectures and security best practices for internal teams
• Integrated and implemented SIEM and EDR in hybrid cloud environments (AWS, Hetzner), planned and carried out EDR/XDR rollouts, and configured log source integration
• Developed and implemented SIEM use cases to improve threat detection and adapt it to specific business requirements
• Built vulnerability management: designed and integrated vulnerability scanners (Tenable Nessus), assessed and remediated security vulnerabilities, and defined corresponding policies
• Designed and wrote ISMS policies according to ISO 27001, NIS2, and CIS v8
• Implemented and managed firewall security solutions (pfSense) and network security monitoring with IDS/IPS (Suricata, Snort)
• Secured web applications based on the OWASP Top 10, integrated security controls into system design and development, and planned and reviewed network segmentation

Technologies: Elastic, Wazuh, Security Onion, Suricata, Snort, pfSense, Tenable Nessus, Sumo Logic, Ansible, Terraform, GitLab, Docker, AWS Cloud, Hetzner Cloud, ISO 27001, CIS v8

• Implementation and management of Fortinet security solutions and network security monitoring
• Implementation and consulting on SD-WAN, including technical consulting for the setup of underlay and overlay networks
• Network design for customer environments, as well as planning and review of current network segmentation
• Connecting network devices to a central management console for advanced control
• Definition and development of security policies based on business requirements

Technologies: Fortinet (FortiManager, FortiExtender, FortiGate), Wireshark, Nmap

• SIEM administration and service monitoring in compliance with SLAs and KPIs, as well as administration of network and security infrastructure (via SIEM and EDR)
• Design and consulting for the setup of the security operations platform and integration of critical infrastructure areas
• Setup, configuration, and integration of log sources with the SIEM, as well as configuration and monitoring of EDR/NDR systems
• Leading and coordinating security incident response activities for the rapid detection, analysis, and containment of security incidents, including triage and mitigation measures
• Implementation of detection rules in the EDR (SentinelOne), as well as selection and configuration of Sentinel use cases
• Design of the security incident handling process and creation of a SOC reporting baseline for compliance and management levels
• Identification of vulnerabilities in web applications using Burp Suite and OWASP ZAP, as well as definition and tracking of remediation measures
• Implementation of zero-trust security strategies through continuous verification and authentication, as well as automation of cross-system and cross-application integrations via interfaces/APIs

Technologies: Microsoft Sentinel, Microsoft Defender, IBM QRadar, Darktrace, Elastic, Wazuh, SentinelOne, FortiGate, Burp Suite, OWASP ZAP, Tenable Nessus, Wireshark, Nmap, Linux, ISO 27001

• Interface contact between Mercedes-Benz Group AG and Telekom AG
• Administration and 2nd-level support, including incident, change, and release management
• BCM process review and coordination of BCM development and adjustments
• Identification of vulnerabilities and opportunities for improvement in CAD, CAE, and CAM workflows to increase efficiency
• Introduction and integration of new software solutions, adaptation of existing systems, and delivery of training