Lakhdari Rida Mohammed

SOC Analyst (Tier 1) | Network Security Engineer

Profile summary

Career highlights

Key skills

Professional experience

Directs instructional delivery for the Purple Team Bootcamp, shaping educational content and structuring evaluation frameworks for the entire student cohort. Steered the creation of technical lab environments and established feedback loops for student investigations.

• •Instructed 50 students in the Purple Team Bootcamp, covering practical lab scenarios and grading investigation reports across the cohort.
• •Authored Week 5 and Week 6 Windows forensics and vulnerability management scenarios, complete with answer keys and grading rubrics.
• •Designed lab components incorporating Sysmon detection engineering, Velociraptor threat hunting, and command and control beacon analysis.
• •Integrated Windows event log forensics and MITRE ATTACK mapping into the curriculum deliverables.

Executed engineering tasks focused on internal SOC platforms, event streaming search, and user access control frameworks. Developed security tools and event collection agents while deploying specialized training applications into production environments.

• •Designed, developed, and deployed the 2MS SIEM platform, featuring real-time streaming search over large event volumes, alert management, role-based access control, and monitoring dashboards now running in production.
• •Built an event-collection agent that gathers and streams security events into the SIEM pipeline in real time.
• •Developed CSense, a gamified security-awareness training platform, and SonaVault, an offline three-factor password vault, receiving a Certificate of Honor for Project Completion and Deployment from the DTI.

Contributed to engineering tasks, supporting security tool development and anomaly detection model creation across 4 projects within an 8-week program.

• •Engineered a Python packet sniffer for live traffic inspection and a JPEG file-carver that recovered files from raw disk images.
• •Built a keylogger for awareness research and a credit-card fraud-detection pipeline using Isolation Forest, Local Outlier Factor, and One-Class SVM anomaly detection.
• •Documented each project in a technical report published on GitHub.

Engaged with engineering teams during a professional immersion, shadowing live network monitoring operations, configuration management procedures, and incident response workflows across the fiber-optic backbone.

• •Observed live network monitoring and configuration management workflows across the operator backbone to gain practical insight into daily operations.
• •Proposed a practical remediation for a customer support workflow gap by applying VLAN segmentation, ACLs, and port security concepts.

• •Resolved 20+ hardware and software incidents across Windows, Linux, and macOS via root-cause analysis, cutting average client resolution time by 30%.
• •Hardened 15+ client systems through patching and baseline enforcement.

• •Deployed Wazuh SIEM and XDR across Ubuntu, Windows 11, and Kali endpoints while authoring 15+ MITRE ATT&CK-mapped correlation rules covering brute force, privilege escalation, credential access, and lateral movement.
• •Scanned endpoints with Nessus, identifying 85 authenticated findings including a manually exploited CVE-2011-2523 backdoor.

• •Authored a formal incident-response report featuring SHA-256 IOC hashes and structured remediation steps covering network isolation, KRBTGT double-reset, and RPC segmentation.

Projects

Deployed Wazuh SIEM/XDR across Ubuntu, Windows 11, and Kali endpoints and authored 15+ MITRE ATT&CK-mapped correlation rules covering brute force (T1110), privilege escalation (T1068), credential access (T1003), and lateral movement. Confirmed coverage with live attack simulations; Nessus scans surfaced 85 authenticated findings, including a manually exploited CVE-2011-2523 backdoor.

Built correlated Sysmon detection rules (Event IDs 1, 8, 10) reaching 100% coverage across 3 techniques - PowerShell abuse (T1059.001), LSASS credential theft (T1003.001), and process injection (T1055) - with zero missed alerts, validated via live Mimikatz extraction and a custom C# injector.

Investigated two Active Directory breach scenarios across 1,400+ Suricata events, reconstructing a DCSync credential-theft chain and an IcedID infection with confirmed C2 communication and SMB lateral movement. Authored a formal incident-response report with SHA-256 IOC hashes and remediation steps (network isolation, KRBTGT double-reset, RPC segmentation).

Detected an active Zeus command-and-control channel in a 24-hour capture (2,882 covert connections; about 678 MB exfiltrated), scored CRITICAL (0.97/1.00) with RITA v5 beacon analysis, and delivered a full IOC package mapped to MITRE ATT&CK (T1071.001, T1041).

Built a multi-threaded honeypot emulating SSH, HTTP/WordPress, and MySQL, capturing 100+ real attacker interactions into a structured threat-intelligence database for TTP profiling.

Education

Computer Science, Information Security Specialization | Relevant coursework: Cryptography, Intrusion Detection Systems, Malware Analysis, Operating Systems Security, Secure Software Development, Cloud Security.

• Ranked 5th of 200 students in my batch, earning placement in the Information Security specialization - the department’s highest-entry track.
• Completed the 4th year and entering the 5th and final year (expected completion Jun 2027); semester averages ranged from 14.04 to 17.76 out of 20.
• Relevant coursework: Cryptography, Intrusion Detection Systems, Malware Analysis, Operating Systems Security, Secure Software Development, Cloud Security.

Certifications

Languages