افتخار أحمد

▸ Multi-site field support: Deployed and supported IoT infrastructure across multiple sites for the Madinah Smart City Project managing device commissioning, network connectivity, and server registration across field locations.
▸ Technical coordination: Served as technical point of contact between field teams and the central Monitoring team resolving device alerts, connectivity drops, and data sync issues in real time across sites.
▸ Vendor & team coordination: Coordinated with vendors and remote engineering teams for hardware replacements and advanced escalations; maintained detailed incident logs per project SLA requirements.

• SIEM Operations (Splunk & Wazuh): Performed daily security monitoring, log correlation, alert triage, and IOC analysis
using Splunk and Wazuh SIEM platforms; authored custom detection rules to reduce false positives and improve
threat signal fidelity.
• Endpoint Detection & Response (EDR/XDR): Monitored and managed Microsoft Defender XDR/EDR across enterprise
endpoints; led first-line incident response, isolated compromised machines, and produced L2-ready forensic
investigation reports aligned with NIST SP 800-61.
• Threat Detection & Hunting: Conducted proactive threat hunting activities, identifying lateral movement, privilege
escalation attempts, and persistence mechanisms using MITRE ATT&CK framework TTPs.
• Vulnerability Management: Executed regular vulnerability scans, triaged findings by CVSS severity, coordinated patch
management cycles, and validated remediation — maintaining ISO 27001 compliance across regulated enterprise
systems.
• Identity & Access Management (IAM): Administered Active Directory user lifecycle management, enforced multi
factor authentication (MFA), applied role-based access control (RBAC) policies, and conducted periodic privileged
access reviews.
• Incident Reporting & Compliance: Documented incident timelines, evidence chains, and remediation steps; supported
internal audits and ensured adherence to ISO 27001 and NIST Cybersecurity Framework requirements.
• Security Awareness: Delivered end-user cybersecurity awareness training covering phishing identification, password
hygiene, and secure access practices across the enterprise.

• Regulated SOC Operations: Delivered security operations for a CLIA & CAP nationally accredited US healthcare
diagnostics company — a HIPAA-regulated, SOC 2 environment requiring strict data protection, access control, and
audit compliance.
• SIEM Monitoring & Log Analysis (Splunk): Monitored SIEM dashboards for security incidents across the IT
infrastructure protecting sensitive patient diagnostic data; performed deep log analysis, investigated anomalous
account activity, and escalated confirmed threats per SOC runbooks.
• Privileged Access Management (PAM): Reviewed and audited user privilege assignments, identified over-privileged
accounts, and recommended remediation aligned with PAM best practices and HIPAA data governance controls.
• Incident Escalation: Triaged and escalated security incidents with documented evidence, severity classification, and
recommended containment steps.

Key contributions and achievements:

• Provide technical assistance and troubleshooting for hardware and software issues, ensuring minimal downtime and optimal productivity for end-users.
• Assisted in designing, configuring, and maintaining network infrastructures, monitoring performance, and implementing robust security measures.
• Managed software deployment, updates, and system administration for Windows and Linux systems, ensuring seamless functionality and smooth migrations.
• Created IT documentation and maintained comprehensive guides to support efficient knowledge transfer within the team.