MD SAAD

Remote · 24×7 enterprise SOC · employer name withheld; references on request

• Monitor, detect and respond to security incidents under defined policies and SLAs; lead compliance-management initiatives alongside analyst duties.
• Forensic investigation and malware analysis during active incidents; threat hunting, vulnerability assessment and red-team activity across enterprise networks, AWS, Azure and web/mobile applications.
• Configure and tune SIEM, XDR and SOAR platforms to improve detection fidelity, reduce false positives and accelerate response.
• Python automation for SOC workflows: IOC enrichment, log correlation, alert triage and ticket generation.
• Purple-team exercises with DevOps and engineering; mentor junior analysts to raise SOC maturity.

Remote · managed security service · employer name withheld; references on request

• Ran SOC analyst shifts: triage, escalation and incident documentation inside SLA.
• Built ServiceNow automation for triage and ticketing, cutting manual handling per alert.
• Assisted Azure red-team operations; authored an internal assistant application for cloud attack-path validation.

Internship → junior analyst · employer name withheld; references on request

• Network and web-application penetration testing: SQL injection, XSS and misconfigurations, with risk-analysed reports and remediation guidance.
• Hands-on engagements with Burp Suite, Nmap, Metasploit and OWASP ZAP.
• Vulnerability scanning and risk assessment; co-authored security policies, procedures and incident-response playbooks.

• quillback — offline, deterministic red-team harness for AI agent scaffolds. 18 attacks mapped to OWASP ASI 2026; SARIF export; 19 findings on a vulnerable reference agent, 0 on the hardened variant, asserted in CI both directions. v0.1.0 released.
• LogAgent-SOC — autonomous threat-hunting pipeline on local open-weight models: zero-shot log parsing with source-span validation, MITRE ATT&CK-grounded ReAct loop, explainable forensic reports, CI-gated CyberMetric benchmark.
• secret-sweep — zero-dependency credential scanner: 23 false positives across 304,467 lines of CPython (0.0076%), 99.5% recall on generated credentials; both figures reproducible via scripts/calibrate.py.
• zero-trust-ai-gateway — RBAC and deep payload-inspection proxy for agent tool calls; blocks destructive SQL, command chaining and reverse shells with an explicit 406.
• Plus: NIST AI RMF compliance mapper, Terraform plan scanner, MITRE→Sentinel KQL generator, phishing triage, and three distributed-systems services (booking engine, double-entry ledger, workflow engine).