Portrait of Rana Talha

Rana Talha

Senior Security Engineer, Dubai

5+ years across threat intelligence, threat hunting, incident response and SOC operations. I turn intel into detections that fire on real problems instead of noise.

name
Rana Talha
role
Senior Security Engineer, Finclutech
focus
Threat intelligence, threat hunting, incident response, SOC operations
tools
Microsoft Sentinel, Wazuh, MISP, OpenCTI, SentinelOne, Google SecOps
location
Dubai, UAE, open to relocating to Germany and the EU
Rule matched: profile decoded, all fields extracted, no fallback

What I work on

Threat intelligence
Tracking APT groups, managing IOCs in MISP and OpenCTI, and OSINT and dark-web monitoring for exposed credentials.
Threat hunting and detection
Hunting with KQL and Elastic Query DSL, and turning TTPs into SIEM detections mapped to MITRE ATT&CK.
Incident response
Triage, forensic analysis, containment and escalation across CrowdStrike, Defender for Endpoint and SentinelOne.
SIEM engineering
Deploying and tuning Sentinel, Wazuh, QRadar and ELK, including custom decoders, playbooks and false-positive reduction.
Cloud security
Hardening AWS and Azure with GuardDuty, Security Hub and Defender for Cloud, and least-privilege IAM.

Selected work

Wazuh-talos-linux

Wazuh decoders, detection rules and field notes for monitoring Talos Linux and Kubernetes nodes over syslog, where no agent can be installed. Built against live production traffic, including the parsing traps that make decoders fail without an error.

  • 30decoders
  • 32rules
  • 11MITRE techniques
  • 13documented gotchas

Read the code and notes on GitHub

Wazuh-playbooks

Practical playbooks for running Wazuh 4.14 in production: a custom VirusTotal IP lookup on FortiGate alerts, SentinelOne threat ingestion, custom rules and decoders, and CDB lists for IOC matching. Configs are pulled from a live manager by a redaction script, and every push runs CI checks for valid XML and JSON, rule ID collisions and leaked secrets across the full history.

  • 4playbooks
  • 5CI checks per push
  • 4.14Wazuh version

Read the playbooks on GitHub

ThreatScribe

An n8n workflow that turns a security news link posted in Slack into a client-ready threat advisory. It scrapes the article past redirects and bot walls, drafts a structured CTI analysis with an LLM, extracts severity, CVSS and CVEs, and posts a styled HTML report back into the thread. Analysts review and send instead of writing from scratch.

  • 1link in
  • 11workflow nodes
  • 8report sections
  • 4page HTML advisory

See the workflow on GitHub

ShiftRelay

An n8n workflow that automates SOC shift handovers. One Slack command reads the client's alert log from a SharePoint workbook through Microsoft Graph, dedupes and counts alerts by source, severity and status, then posts the full handover to the SOC's Slack channel and a client-facing summary to Microsoft Teams. The incoming shift is tagged automatically.

  • 1Slack command
  • 12workflow nodes
  • 2channels: Slack and Teams
  • 0secrets in the workflow

See the workflow on GitHub

Internal tools I built

Experience

  1. Aug 2024 – now

    Senior Security Engineer

    Finclutech, Dubai

    • Profile APT groups and turn their TTPs and IOCs into Sentinel detections and hunting hypotheses.
    • Manage threat intel in MISP and OpenCTI and feed OSINT and dark-web findings into SOC workflows.
    • Automate incident workflows with Sentinel playbooks for a 24/7 SOC.
    • Run firewall (Fortinet, Check Point), DLP (Purview, Defender) and vulnerability management aligned with NIST.
  2. Apr 2026 – now

    SOC Analyst (contract, remote)

    SicuraNext, Italy

    • Alert triage and incident analysis for EU clients using Google SecOps, Zscaler, Lacework and AWS GuardDuty.
  3. Jun 2022 – Jul 2024

    Security Engineer, SOC L1 to L2

    Ebryx, Lahore

    • 24/7 monitoring across Sentinel, QRadar, Wazuh and ELK with CrowdStrike, Defender for Endpoint and VIPRE.
    • Led enterprise Wazuh and SIEM deployments, from architecture to custom detection rules.
    • Owned advanced investigations and escalations, mentored junior analysts and presented threat reports to clients.
    • Named best performer of the quarter.
  4. Mar 2020 – Apr 2022

    Cloud Security Engineer (remote)

    CrocusZone, USA

    • Configured AWS and Azure security controls, tightened IAM and S3 permissions, and collected forensic artefacts for investigations.

Certifications

Background

Education
BSc Information Technology, University of Management and Technology, Lahore (2018–2022)
Languages
English (professional), Urdu (native), German (A1, learning)
Frameworks
MITRE ATT&CK, Cyber Kill Chain, NIST, ISO 27001, SOC 2, CIS

Get in touch

Based in Dubai and open to senior security roles in Germany and the EU. The fastest way to reach me is LinkedIn.

LinkedIn GitHub