Greater Paris Metropolitan Region
10 years in OT and ICS cybersecurity, across Oil & Gas, energy, utilities, transportation, and critical infrastructure. The mandates have been substantial: a major international LNG megaproject, the Paris 2024 Olympic Games airports, a 105-site global OT SOC covering four regions. The results speak for themselves: 26 detection rules built from scratch, false positive rate dropped from 60% to 15%, 109 ICS systems secured under national mandate, one 220K€ mission that generated a 1M€ follow-on contract. IEC 62443 and NIST SP 800-82 are my working standards, not frameworks I consult. In practice: SOC L3 operations, Incident Response, DFIR investigations on active OT threats, Threat Hunting, and Detection Engineering in Splunk and Nozomi. The threat scenarios are real: TRITON, Industroyer, MITRE ATT&CK for ICS. Orchestration through Cortex XSOAR, endpoint coverage with Velociraptor and CrowdStrike EDR. On the architecture side, I design zone and conduit segmentation following the Purdue Reference Model, validate multi-vendor packages through FAT/SAT, and deliver full OT asset inventories across SCADA, DCS, PLC, HMI and SIS environments running Modbus, DNP3, and OPC-UA. Open to exchanges with OT security professionals and industrial stakeholders across the GCC.
Sole senior OT engineer building and operating Engie's 105-site global OT SOC across Saudi Arabia, UAE, LATAM and Europe. Engineered 26 OT detection rules in Splunk and Nozomi Vantage Covered TRITON and Industroyer TTPs via MITRE ATT&CK for ICS mapping Reduced false positive rate from 60% to 15% across 105 sites Directed L3 forensic investigations via XSOAR, CrowdStrike EDR and Velociraptor Performed root cause analysis and containment on every OT incident Architected OT data collection strategy across 105 sites in 4 regions Onboarded industrial sites across KSA, UAE, LATAM and Europe to SOC Trained 10 SOC L3 analysts, all achieving Nozomi NNSA certification Designed process-aware detection rules using sensor and actuator state context
Built security visibility for more than 100 industrial control systems across airport infrastructure. Conducted full asset inventory using industrial monitoring solutions. Designed secure architectures for OT environments and industrial systems. Investigated cybersecurity incidents in operational environments. Developed cybersecurity resilience strategies for critical infrastructure systems.
Performed industrial asset discovery across multiple international sites. Designed backup and recovery strategies for PLC and industrial systems. Strengthened identity and access management in OT environments. Conducted security assessments on industrial networks and systems. Developed cybersecurity documentation and business continuity plans.
Performed internal and external penetration testing on enterprise and industrial systems. Reviewed SCADA and industrial control system architectures. Conducted risk assessments based on international cybersecurity standards. Participated in incident response and CSIRT activities. Developed ransomware response playbooks and security audit reports.
Managed cybersecurity innovation and research projects in Industry 4.0 environments. Coordinated between technical and business teams to evaluate cybersecurity feasibility of industrial solutions. Supported cybersecurity innovation initiatives and workshops to validate security concepts in complex industrial systems. Contributed to risk assessment of emerging industrial technologies and solutions.