Network & Cybersecurity Engineer — SOC (Final-Year Internship / PFE)
Innov Alliance Tech (IAT) — Tunis, Tunisia
• Designed and deployed a full SOC (SIEM, SOAR, Threat Intelligence, IDS/IPS, NGFW) on a segmented network (SOC, DMZ, Active Directory), containerized with Docker Compose on VMware, delivered in Scrum over 6 sprints.
• Deployed and administered SIEM Wazuh 4.14 (agents, Wazuh Indexer built on OpenSearch/ELK) for log collection, normalization, correlation and real-time security-event analysis, with custom detection rules.
• Coded the SIEM-to-firewall automation layer: correlated Wazuh alerts against IOC feeds and triggered automated blocking rules on the Palo Alto PA-220 (NGFW/IPS), closing the loop from detection to containment without manual intervention.
• Investigated 5 attack scenarios end to end (Nmap reconnaissance, DoS, SSH brute-force, DNS C2/sinkhole, malware IOC), mapped to MITRE ATT&CK, opening and documenting cases in TheHive and enriching indicators via Cortex and MISP.
• Configured and administered Palo Alto PA-220 (NGFW/IPS) and Fortinet firewalls: security policies, NAT, VPN, VLAN segmentation, switching and log-based hardening.
• Built a Python SOAR orchestrator (REST API, webhooks, IOC cache, automated IPS blocking engine, TheHive-to-MISP feedback loop) that cut manual triage time and sped incident response.
• Tracked SOC KPIs (MTTD, MTTR, automation rate, false-positive rate, confusion matrix) via Grafana/Prometheus/Loki as core performance-monitoring metrics, and authored the full technical validation report and incident reports.
