Muhammad Ahmed – Cybersecurity Analyst

// 01 Professional Summary

Cybersecurity-focused IT professional with 20+ years of infrastructure, networking, and systems engineering experience transitioning into Security Operations (SOC) and detection engineering. Recently achieved CompTIA Security+ (SY0-701) with hands-on experience in SIEM, IDS/IPS, threat detection, and incident analysis through lab projects and TryHackMe learning paths. Deep background in Windows/Linux administration, networking, virtualization, and cloud platforms provides a strong foundation for identifying and responding to threats across complex enterprise environments.

// 02 Cybersecurity Skills

Security Operations

Security event triage & investigation
Alert analysis and escalation
Incident response fundamentals
MITRE ATT&CK mapping
IOC analysis and enrichment
Threat hunting basics

SIEM & Log Analysis

Splunk (alert investigation, dashboards)
Microsoft Sentinel (workspace setup, analytics rules, KQL queries)
Elastic / ELK Stack
Windows Event Log analysis
Linux log analysis
Detection rule tuning

Network Security

Suricata IDS/IPS rule-based detection
Wireshark packet analysis
TCP/IP, DNS, HTTP, TLS investigation
Firewall & network traffic monitoring

Endpoint Security

Sysmon log analysis
Windows security event monitoring
Authentication & brute force detection
Privilege escalation indicators

Threat Analysis

Phishing email analysis
Malware behaviour basics
Attack chain & kill chain analysis
Threat intelligence application

// 03 Certifications

SEC+

CompTIA Security+ (SY0-701)

2026

AWS

AWS Certified Solutions Architect – Associate

2020

RH

Red Hat Certified System Administrator (RHCSA)

2018

VCP

VMware Certified Professional – DC Virtualization

2016

MS

Microsoft Certified Systems Engineer (MCSE)

2004

CCNA

Cisco Certified Network Associate (CCNA)

1999

// 04 TryHackMe Training

Cyber Security 101 Path

Cybersecurity fundamentals & threat landscape
Security controls and defense layers
Authentication and access control concepts
Network security fundamentals
Vulnerability and risk basics

SOC Level 1 Path

SOC workflow, alert triage & escalation
SIEM investigation & log correlation
MITRE ATT&CK framework application
Threat detection methodologies
Incident response lifecycle
IOC analysis and enrichment
Phishing investigation, network traffic analysis

// 05 Security Projects

SOC Detection Lab
Splunk + Suricata + Elastic

Built home SOC lab for threat detection and monitoring
Integrated Suricata IDS for network-based alert generation
Configured log ingestion into Splunk and Elastic SIEM
Created dashboards for authentication monitoring
Investigated alerts and performed event correlation
Tuned detection rules to reduce false positives

Network Traffic Analysis

Captured and analysed packets using Wireshark
Investigated DNS, HTTP and TLS traffic patterns
Identified suspicious network connections
Correlated findings with IDS alerts
Performed basic threat hunting using network data

Brute Force Detection Project

Simulated SSH and RDP brute force attacks in lab
Analysed authentication logs in SIEM
Created detection queries and alerting logic
Investigated source IPs and attack timelines

Windows Security Monitoring

Analysed Windows Event Logs for suspicious activity
Monitored failed logins & privilege escalation attempts
Used Sysmon telemetry for process execution monitoring
Built detection logic for abnormal authentication behaviour

Microsoft Sentinel SIEM Lab

Provisioned a Microsoft Sentinel workspace in Azure; configured Log Analytics workspace and connected data connectors (Azure AD, Windows Security Events, Microsoft Defender for Cloud)
Deployed and configured Microsoft Monitoring Agent (MMA) and Azure Monitor Agent (AMA) on Windows VMs to forward security event logs to Sentinel
Created scheduled analytics rules using KQL to detect failed login attempts, privilege escalation, and suspicious process execution; tuned thresholds to reduce false positives
Built Sentinel Workbooks for security dashboards visualizing incident trends, alert volume, and top threat indicators across the environment
Investigated generated incidents using Sentinel’s incident investigation graph; correlated entities (users, hosts, IPs) and mapped findings to MITRE ATT&CK techniques
Configured automation rules and basic Playbooks (Logic Apps) to auto-assign and notify on high-severity incidents

// 06 Professional Experience

Independent IT Contractor

Self-Employed · Brampton, ON

2020 – Present

Deliver infrastructure, server management, and network support to SMB clients; configure firewalls, VPNs, and secure remote access
Deploy AWS, Azure, and Google Cloud solutions; implement secure cloud storage, hosted email, and MDM
Perform system hardening, vulnerability assessments, and security best-practice reviews for client environments
Design and implement backup, DR, and business continuity solutions

Senior IT Systems Engineer

NetPLUS IT Solutions Inc. · Toronto, ON

2015 – 2020

Managed Windows/Linux server infrastructure and VMware/Hyper-V virtual environments for enterprise clients
Resolved complex network and system incidents; maintained LAN/WAN infrastructure and security controls
Administered firewalls, monitored network performance, and enforced security policies across client environments

Technical Support Engineer

Computer XS Inc. · Waterloo, ON

2011 – 2015

Administered Active Directory, Exchange Server, and Hyper-V; configured Cisco networking and UTM firewalls
Resolved critical issues including corrupt AD, mail-flow failures, and disaster recovery across SMB client sites

Senior Technical Support Engineer

Synergy Computers (Pvt.) Ltd. · Lahore, Pakistan

2007 – 2011

Led design, architecture, and support of Windows and Red Hat Linux infrastructure solutions for enterprise clients

Server Support Advisor

Dell Computer Corporation · Round Rock, TX, USA

2002 – 2006

Provided expert-level remote support to Fortune 500 IT admins; served as final escalation for critical infrastructure incidents
Mentored junior engineers and documented solutions for the global knowledge base

// 07 Technical Skills

Security Tools	Splunk, Elastic/ELK Stack, Suricata IDS, Wireshark, Sysmon, Windows Event Logs
OS	Windows Server (2000–2016), Red Hat Enterprise Linux, Ubuntu, Windows 10/11
Cloud	AWS (EC2, S3, VPC, CloudWatch, Route 53), Microsoft Azure, Google Cloud Platform
Networking	TCP/IP, DNS, DHCP, VLANs (802.1Q), VPN, OSPF, EIGRP, BGP, Active Directory
Virtualization	VMware ESXi, vCenter, HA/DRS, Microsoft Hyper-V, Docker, Kubernetes
Scripting / Dev	PowerShell, Bash, Git, Jenkins, Ansible

// 08 Education

Master of Science – Electronics

Quaid-e-Azam University · Islamabad, Pakistan

1989 – 1991

Equivalent to North American Bachelor's Degree