Mohamed Sabry Hamdan

SOC Analyst | Blue Team | DFIR | Threat Detection | Incident Response | Open to Remote

Egypt

About

SOC Analyst (Tier 1) | Blue Team | DFIR I detect threats, investigate incidents, and build tools that make security operations faster and smarter. I work across Splunk, ELK, Wazuh, and Microsoft Sentinel — handling alert triage, IOC extraction, log analysis, and incident response from detection to documentation. I map findings to MITRE ATT&CK and export structured threat intelligence in STIX 2.1. I built ThreatScope, an open-source Python detection engine with 308 rules, 274 MITRE ATT&CK mappings, and a 35-rule correlation engine — used in a SOC lab that processed 17,000+ log lines and detected 400+ security events across real attack scenarios. On the forensics side, I work with Autopsy, FTK Imager, and Volatility for disk and memory analysis — including malware investigations involving obfuscation, MOTW bypass, and persistence mechanisms. Currently also teaching SOC at Zero2Aura,. Open to remote or Egypt-based SOC Analyst roles. Tools: Splunk | ELK | Wazuh | Microsoft Sentinel | Autopsy | Volatility | Python | MITRE ATT&CK | STIX 2.1

Experience

  • Digital Forensics investigator at Digital Egypt Pioneers Initiative - DEPI
    Nov 2025 - Present · 8 mos

  • Founder & cyber security instructor at Zero2Aura
    Oct 2025 - Present · 9 mos

  • Scholarship Trainee – Translation, SEO & Graphic Design at Lingua stochos
    Aug 2025 - Nov 2025 · 4 mos

    english - english translating -intro to seo - intro to graphic design

  • Be Ready internship at Be Ready
    Aug 2025 - Aug 2025 · 1 mo

  • Cyber security incident response analyst at Digital Egypt Pioneers Initiative - DEPI
    Oct 2024 - May 2025 · 8 mos