I’m Rania Saleh, a SOC analyst in Dubai with six years on the night shift and the day shift of a regional bank’s 24/7 security operations centre.
I triage alerts, hunt for what the alerts miss and write the detections and playbooks that make the next incident shorter. Most of my week is Splunk, Microsoft Sentinel and CrowdStrike.
Lately I’ve been turning repeat work into automation: phishing triage that used to take 20 minutes now takes under 3, with an analyst checking every verdict.
I think the best defenders understand attackers. That’s why I keep a home lab, play blue-team CTFs and write up what I learn.
A playbook that pulls reported emails from the shared mailbox, opens links in a sandbox, scores them and raises a ticket with the verdict. An analyst approves every closure. Triage went from 20 minutes to under 3.
Forty detection rules for Windows and Microsoft 365, mapped to MITRE ATT&CK, converted to KQL and SPL, each with a test case so it can be checked after every change.
A two-hour tabletop exercise with injects, a decision log and a one-page runbook, used to rehearse the first hour of a ransomware incident with IT, legal and communications.
Lead investigations escalated from Tier 1 across 9,000 endpoints and the bank’s cloud tenants. Wrote 40+ Sentinel and Splunk detections, cutting false positives on the noisiest rules by 35%. Run the monthly threat hunt and write up its findings for the risk committee.
Monitored alerts for 14 clients in retail, logistics and government on rotating shifts. Triaged phishing, malware and brute-force alerts, and escalated with clear, timestamped notes. Wrote the team’s first phishing playbook.
Final project: an intrusion detection system for small office networks.
Open to senior SOC and detection roles. I respond fast — drop a message.