// Computer Engineering · ENISO · Tunisia · Class of 2027
Oussama
Ghali
Cybersecurity Engineer · SOC Builder · Top 5% TryHackMe
Building proof-driven security work: Azure honeypots, SIEM monitoring, Cisco NetAcad certifications, and offensive labs that show real-world impact.
Hands-on labs, cloud defense, and internship-ready proof
// 01 · About
Who Am I?
// 02 · Experience
Field Work
- Deployed SIEM monitoring multiple endpoints — generated and analyzed 100+ security alerts from simulated attack scenarios
- Detected brute-force, privilege escalation, and suspicious process execution patterns
- Tuned detection rules to reduce noise and improve alert relevance during testing
- Performed log correlation across system, auth, and network events to reconstruct attack timelines
- Ranked in the top 5% on TryHackMe through consistent practice and challenge completion.
- 50+ hands-on challenges covering web exploitation, Linux privesc, and network enumeration
- Applied real-world recon → exploitation → post-exploitation methodology on vulnerable systems
- Sharpened analytical speed under time-constrained, competitive scenarios
- Coordinated cybersecurity workshops and events impacting 50+ students
- Led internal organization, communications, and execution of technical sessions and CTF prep
// 03 · Projects
Featured Work
- Deployed the honeypot on Azure and exposed it for controlled internet-facing observation.
- Tracked attacker IPs, passwords, usernames, and shell commands to understand real-world probing patterns.
- Packaged the findings into a dashboard view for faster triage and reporting.
- Built a full traffic pipeline from attack generation to packet capture, detection, and SIEM correlation.
- Combined signature-based detection (Suricata) with ML-based scoring to improve visibility on suspicious flows.
- Integrated alert artifacts (eve.json and ml_alerts.json) into Wazuh to centralize logs and investigation context.
- Validated the ML stage on NSL-KDD with 99.62% accuracy in lab evaluation.
- Attack scenarios implemented: SQL Injection, XSS payload injection, and IDOR access bypass.
- Detection scenario: suspicious input patterns and auth/resource events correlated for analysis.
- Defense scenarios documented: parameterized queries, output encoding, and authorization checks.
// 04 · Skills
Arsenal
// 05 · Contact
Let's Connect
Looking for a
cybersecurity internship.
SOC analyst, blue team, or offensive security roles —
ready to contribute from day one with real hands-on skills.
Currently seeking a cybersecurity internship opportunity where I can apply SIEM, offensive testing, and AI automation skills in a real security environment.
Send Message