فيصل الشمراني

• Worked in a shift-based 24x7 SOC environment; closed over 900 SIEM alerts daily.
• Performed daily malware scans across the entire network using Kaspersky Endpoint Security.
• Investigated Kerberoasting alerts using PowerShell, SPN enumeration, and event log analysis.
• Blocked malicious IPs through F5 WAF iRules and enforced perimeter defences.
• Detected and responded to host compromises involving DLL injection, persistence, and beaconing.
• Created YARA rules and carried out endpoint containment including isolation, credential resets, and system wipes.
• Performed forensic analysis of compromised hosts, including memory dump analysis Volatility, and Windows artifact
correlation (Prefetch, Amcache, SRUM, Shimcache, JumpLists, registry hives) to validate execution timelines and
persistence.
• Implemented SIEM use cases to detect PowerShell activity.

• Detected unauthorized persistence by auditing registry run keys, startup folders, and Winlogon settings with PowerShell,
revealing suspicious entries linked to malicious startup behaviour.
• Analysed a memory dump with Volatility to detect .NET-based malware infection on a suspected endpoint; extracted
malware artifacts and confirmed in-memory execution behaviour.
• Investigated APT activity across an enterprise Splunk SIEM by analysing multiple indexes and threat intel; mapped attacker
movement across the kill chain and identified compromise indicators including initial access, lateral movement, and
persistence.
• Hunted for specific MITRE ATT&CK techniques (T1099, T1055, T1021, etc.) using ELK stack, including timestomping,
Meterpreter migration, and credential harvesting; successfully identified multiple TTPs and correlated them with attacker
activity timelines.
• Validated sender authenticity by reviewing HTTP and email headers (SPF, DKIM, DMARC), and inspected user-agent, host,
referrer, and URI paths in HTTP traffic, resulting in the detection of phishing attempts, unauthorized access, and data
exfiltration over DNS and HTTP(S).
• Investigated web-based malware delivery using EnCase and browser artifact parsers, traced Quasar RAT infection to
Chrome browsing activity, and confirmed payload download via HTTP.
• Analysed suspicious executables with EnCase, inspecting metadata, compile times, and hash values to identify malware
disguised as legitimate binaries (e.g., client-built.exe).
• Mapped execution of manually deployed malware using WinPrefetchView and EnCase, confirmed METSVC.EXE execution
by the user, and verified its persistence via scheduled tasks.
• Investigated anomalies involving TCP/IP traffic, DNS tunnelling, and unauthorized port scanning attempts.

• Worked in a shift-based SOC environment with 24x7 alert monitoring responsibilities.
• Utilised ECC, DCC, and SAMA CSF controls to verify compliance, including vulnerability patching, user management, and
overall cyber security posture.
• Blocked over 15 instances of external scanning on the perimeter firewall.
• Investigated and triaged 50+ security incidents by analysing EDR alerts, Windows Event Logs, DNS records, and firewall
logs; escalated valid threats to seniors per playbook.
• Prioritised vulnerability scans using Qualys VMDR, resulting in the monthly remediation of over 10 critical vulnerabilities.
• Designed and delivered the 2024/25 cyber security awareness programme for the entire organisation, including awareness
emails, posters, quizzes, and phishing simulations to assess effectiveness.
• Developed, deployed, and demonstrated threat intelligence platforms (OpenCTI and MISP) to address a gap identified in
the GRC assessment.
• Independently verified and responded to SAMA threat intelligence reports by scanning the environment for artefacts and
correlating findings with OSINT sources.
• Maintained incident records using Jira; documented alert context, actions taken, and escalation notes in compliance with
SOC operating procedures.