Shahzeb Masroor

Surfacing threats before they become incidents | SOC Analyst · Threat Hunter · Incident Response | Microsoft Sentinel · Sigma · KQL · SPL | SC-200 · Splunk Core Certified Power User · Security+

Canada

View resume

Skills

- SIEM & Detection: Splunk (SPL), Microsoft Sentinel (KQL), Defender XDR, Sigma, log ingestion, event correlation, alert creation and tuning
- Threat Operations: alert triage, threat hunting, IOC identification, incident response, false positive filtering, playbook/runbook execution
- Malware & Phishing: static/dynamic malware analysis, YARA, FLARE VM, CyberChef, REMnux, PEStudio, Detect It Easy, CAPA, VirusTotal, AbuseIPDB, phishing investigation
- Digital Forensics: FTK (Forensic Toolkit), Windows memory forensics, endpoint artifact analysis, chain-of-custody
- EDR & Endpoint: Defender for Endpoint, Defender for Office 365, Defender for Cloud, endpoint telemetry analysis
- Network & Traffic: Wireshark, Zeek, Suricata, TCP/IP, DNS, HTTP, protocol analysis, attack vector identification
- Cloud & Identity: Microsoft Entra ID, Azure Log Analytics, Microsoft 365 E5, AWS (fundamentals), IAM user and group management
- Vulnerability Management: Tenable, CVSS scoring, CVE/CWE analysis
- Scripting and Ticketing: KQL, SPL, PowerShell, Bash, Python (fundamentals), ServiceNow, Zendesk, ITSM
- Frameworks: MITRE ATT&CK, NIST CSF/800-37/800-53/800-61, Cyber Kill Chain, OWASP Top 10, PCI-DSS, DISA STIG, HIPAA
- Operating Systems: Windows Server 2022, Windows 10/11, Linux

About

Triaging over 100+ investigations.
Conveying business impact to stakeholders through case documentation
Driving tickets through the full SANS/NIST IR lifecycle using ticketing platforms
Writing investigative queries and tuning alerts (10+) using KQL, SPL & Sigma
Experienced with SIEM (Splunk & Microsoft Sentinel), MITRE ATT&CK, Malware Analysis.
Experience creating SOAR pipelines incorporating AI workflows.