Esmail Nouralden

Cybersecurity Analyst

Cybersecurity Analyst with hands-on experience in SOC operations, log analysis, threat detection, and Linux administration. Skilled in Splunk, IBM QRadar, ELK Stack, Suricata, Wireshark, and Python for security monitoring, alert triage, and incident response. Knowledgeable in phishing investigation, malware analysis basics, brute-force attacks, ransomware scenarios, and network traffic analysis.

SOC OperationsThreat DetectionIncident ResponseSIEM Monitoring

Contact Download CV LinkedIn +201003546479

Skills

Technical Skills

SIEM & Monitoring

SplunkIBM QRadarElastic ELK StackWazuh

Detection & Analysis

Wireshark (PCAP)Suricata (IDS/IPS)MITRE ATT&CKIOC analysisthreat triage

Security Tools

Trellix (EDR/XDR/NDR)Palo AltoBurp SuiteMetasploit

Incident Response

Alert validationlog correlationescalation reportingDFIR fundamentals

Networking

TCP/IPHTTP/HTTPSDNSFTPSSHVPNFirewalls

Systems

Linux AdministrationWindows Server

Programming

PythonC

Experience

Professional Experience

Linux System Administrator

Oct 2024 - June 2026

ISTQSERVERMaadi, Egypt

Maintain and harden Linux servers, ensuring 99.9% uptime and secure operations.
Conduct system audits, patching, and health checks to reduce vulnerabilities.
Monitor and analyze logs, troubleshoot servers, coordinate with datacenter teams.

Cybersecurity Trainee

Sep 2025 - Nov 2025

National Telecommunication Institute (NTI)Internship

Performed SOC, network, and cloud security labs using F5 and Trellix.

Projects

Graduation Project

Smart Road Security System

Built an AI-based stolen car detection system in Python/C paired with real-time alerting.

PythonCAIReal-time Alerting

L1 Analyst — Hands-on

Security Triage Project

Ingested and correlated Windows, Linux, and Suricata logs in Splunk; validated alerts, analyzed PCAP traffic, identified IOCs mapped to MITRE ATT&CK.

SplunkWiresharkMITRE ATT&CKPCAP

SIEM Lab Engineer / SOC Analyst

IBM QRadar SIEM Lab — Linux & Windows Log Integration

Built a hands-on IBM QRadar SIEM lab and configured Linux and Windows log ingestion. Integrated Linux logs using rsyslog over Syslog and Windows Event Logs using IBM WinCollect. Validated event ingestion through Log Activity, tcpdump, and AQL searches. Created custom DSM parsing, regex-based custom properties, and QID mappings for authentication, privilege escalation, user creation, and command execution events.

IBM QRadarSIEM

SOC Analyst / Security Investigator

SSH Brute Force Investigation using Wazuh SIEM

Built a hands-on Wazuh SIEM investigation lab to detect and analyze SSH brute-force activity using Linux authentication logs and endpoint telemetry. Correlated failed SSH login attempts with Wazuh alerts to identify the attacker source IP, targeted accounts, MITRE ATT&CK T1110/T1110.001 mapping, and confirmed that no successful authentication occurred.

WazuhSIEMSOCBlue TeamIncident ResponseLinuxMITRE ATT&CK

Read write-up

Education

Sep 2019 — Jul 2024