Cybersecurity Analyst — Detection Engineering · SOC Operations · Security Automation
📍 Amman, Jordan · ✉️ tamerktb2003@gmail.com · 💼 LinkedIn
I build detection and response systems, not slide decks — and I make them run.
My projects deploy real infrastructure: a Splunk app that catches SSH credential-stuffing and impossible-travel logins against live threat-intel feeds, a self-provisioning AWS SOC lab built with Terraform, and a Zero Trust gateway that inspects every API call an AI agent makes.
Hands-on experience at Jordan's National Cyber Security Center (NCSCJO) and Green Circle for Cybersecurity, spanning SOC operations, penetration testing, GRC compliance, and AI-driven security automation.
| Project | What it does | Proof |
|---|---|---|
| ZT-Agent-Proxy | Transparent HTTP proxy that inspects, rate-limits, and audits every AI-agent API call. 27 detection rules (prompt injection, secrets, PII, injection), tamper-evident hash-chain audit log, HTML dashboard. | 33/33 tests pass · CI on Python 3.11–3.13 |
| SSH Log Analysis — Splunk | Deployable Splunk app: 9 correlation searches (brute force, credential stuffing, impossible travel, dormant accounts), CIM-mapped, fed by live Tor / abuse.ch / Spamhaus intel. Full Elastic 8.15 + ElastAlert 2 port included. | Verified end-to-end against real Hydra brute-force traffic |
| Cloud Security Monitoring Lab | Self-provisioning AWS SOC — Terraform builds VPC, EC2, CloudTrail and VPC Flow Logs; Wazuh SIEM, Cowrie honeypot, and custom detection rules on top. | terraform apply → running detections |
| SASE Deployment Lab | Cloudflare Zero Trust + WireGuard multi-site mesh with device posture checks and split-tunneling. Entirely Infrastructure-as-Code. | CI green · Docker sim + optional real EC2 mesh |
| IOC Enrichment Pipeline | Multi-API threat-intel enrichment with SQLite caching, weighted risk scoring, retry/backoff, and Splunk-ready output. CLI + Streamlit UI. | Graceful degradation + dead-letter logging |
| EDR Home Lab | Sliver C2 vs. LimaCharlie EDR attack-and-defense simulation — LSASS access, ransomware behavior, lateral movement — with detection & response rules for each. | 8 rules · Vagrant-automated VMs |
| Area | Tools |
|---|---|
| Detection & Response | Splunk (SPL · CIM · correlation searches), Wazuh, LimaCharlie, Sysmon, ElastAlert 2, Elastic 8.x |
| Offensive Security | Kali Linux, Sliver C2, Hydra, Burp Suite, OWASP Top 10 web-app testing |
| Cloud & Network | AWS (CloudTrail · VPC · IAM), Terraform, Cloudflare Zero Trust, WireGuard, pfSense, Suricata IDS/IPS |
| Automation & Code | Python, PowerShell, Bash, Docker, Git / GitHub Actions, REST APIs |
| Governance & Risk | ISO 27001, NIST CSF control mapping, risk documentation |
I'm open to SOC analyst, security engineer, and GRC roles, and to security-automation work.
"Security is not a product, but a process." — Bruce Schneier