Open to new opportunities
Shaheer Ul Islam builds detections, not just dashboards.
Cybersecurity professional with 3+ years across SIEM monitoring, alert triage, and detection engineering — mapping real attack simulations to MITRE ATT&CK in Splunk, Microsoft Sentinel, and AWS.
SOC Analyst
Threat Analyst
Cybersecurity Analyst
Cybersecurity Engineer
Blue Team
3+
Years in IT & security operations
30+
Security events triaged monthly
30%
False-positive reduction delivered
MSc
Cybersecurity, Birmingham City University
About Us
Cybersecurity Analyst focused on practical detection engineering
My interest in cybersecurity is rooted in outcomes: turning raw log data into detections that an analyst can act on with confidence. I specialise in detection engineering — designing and tuning detection rules, reducing alert noise, and mapping findings to the MITRE ATT&CK framework so each alert carries clear, actionable context.
3+ years of combined IT and security operations experience. Core areas of expertise:
SIEM & Detection
Microsoft Sentinel, Splunk, and Wazuh, applied to alert triage, incident response, and detection engineering
Frameworks & Compliance
MITRE ATT&CK mapping; GDPR, ISO 27001, PCI DSS, and NIST CSF compliance frameworks
Identity & Cloud
Azure AD and Microsoft 365 identity management, conditional access and MFA, AWS and Azure security fundamentals
Education & Certifications
MSc in Cybersecurity, Birmingham City University; IBM and Google Cybersecurity Professional Certificates
Communication
Experienced in presenting technical findings clearly to both technical and non-technical stakeholders
Availability
Full right to work in the UK; open to SOC, blue team, threat analyst, and cybersecurity engineer roles, including shift-based work
Background
Experience
Security Operations Analyst — Self-Employed (Freelance)
Oct 2023 – Present
- Delivered SOC monitoring and incident investigation for two small-business clients and one mid-sized business, triaging 30+ security events per month across Microsoft Sentinel, Splunk, and Wazuh.
- Analysed Windows Event Logs (Event IDs 4624, 4625, 4648, 4720) to detect authentication failures, brute-force patterns, and privilege escalation attempts, mapped to MITRE ATT&CK TTPs.
- Reviewed and investigated endpoint detections in Microsoft Defender for Endpoint, including isolating a compromised device and tuning detection policies to reduce noise.
- Deployed and monitored Suricata and Snort IDS sensors, investigating real network intrusion alerts and suspicious traffic patterns.
- Ran vulnerability scans using Nessus, OpenVAS, and Qualys across client networks and lab environments, reviewing findings to support remediation prioritisation.
- Configured DDoS mitigation controls and monitored traffic during an active event to support service continuity.
- Built and tuned 10+ SIEM detection rules, reducing false-positive noise by an estimated 30% and improving alert fidelity and triage efficiency.
- Executed SOC Tier 1 workflows: alert prioritisation, escalation decisions, and structured incident documentation aligned with ITIL practices.
- Configured SOAR playbook automations to accelerate response to recurring alert types, cutting average investigation time by 25%.
- Supported a real server recovery following a client incident, alongside scheduled backups and test restores after software updates.
- Managed Microsoft 365 / Azure AD identities and IAM controls, enforcing MFA and conditional access policies for client environments.
- Set up and supported a client website (ai-reachoutsolutions.com), bringing the same attention to detail to broader technical delivery work.
IT Support Assistant — New Era OS
Jun 2021 – Jun 2022
- Resolved 20–30 support tickets per week with a 95%+ first-call resolution rate, handling L1/L2 hardware, software, Windows, and networking incidents within SLA targets.
- Administered Active Directory accounts for 50+ users, including account provisioning, password resets, group policy, and access control (IAM).
- Maintained structured incident records and knowledge base documentation aligned with ITIL v4 service management practices.
IT Technical Roles (Early Career) — East West Trade, EFA School, Digital Marketing Agency, Pakistan Post Office
2019 – 2021
- Delivered first-line IT support across four organisations, covering hardware, software, networking, and user-access requirements for 100+ end users.
- Troubleshot Windows, network, application, and peripheral issues, escalating complex incidents where required.
Projects
Detection engineering, SIEM & cloud security work
A complete SOC environment I built end to end, plus a set of focused projects across SIEM, cloud security, and automation.
Featured — Sysmon + Splunk Detection Engineering Lab
6
Detections built & mapped to MITRE ATT&CK
5
ATT&CK tactics covered in one lab
193+
Simulated detection events analysed
25+
Hands-on SOC investigation labs (across all projects)
01
Environment & Ingestion Pipeline
Stood up a Windows 11 VM instrumented with Sysmon (SwiftOnSecurity config), forwarding Security, Sysmon, and Windows Defender telemetry into Splunk Enterprise via Universal Forwarder. Debugged Windows Event Log channel permissions and Splunk license-violation lockouts along the way.
02
Attack Simulation & Detection Engineering
Used Atomic Red Team to simulate 6 real attack techniques across 5 MITRE ATT&CK tactics, then wrote and validated 6 custom SPL detections — including catching and fixing a case() logic-ordering bug that was silently miscategorizing events.
03
Live SOC Dashboard
Built a Splunk Simple XML dashboard visualising detection volume, technique breakdown, and event-level detail with colour-coded severity — including debugging real schema validation errors when editing the dashboard source directly.
04
Formal Incident Report
Chained three detections into one narrative — Discovery → Credential Access → Persistence — and documented it the way a real analyst would: timeline, technique analysis, impact assessment, response actions, and remediation recommendations.
SOC Overview Dashboard — live Splunk instance
193 events · 5 techniques · dark theme
Technique
Detection
Status
T1082
System Information Discovery — systeminfo / registry recon via cmd, spawned from PowerShell
Detected
T1059.001
Encoded PowerShell command execution (-EncodedCommand)
Detected
T1047
PowerShell spawned via WMI Provider Host (WmiPrvSE.exe)
Detected
T1003.005
Credential Manager access via rundll32 / keymgr.dll (LOLBin)
Detected
T1053.005
Scheduled task persistence, created to run as SYSTEM on startup
Detected
T1055 / T1003
Process injection & credential-dumping tooling quarantined by Defender AV in real time
Blocked
6 saved SPL detections, each mapped to a MITRE ATT&CK technique ID
Splunk · Search & Reporting
