◎
Security operations & SIEM
Security monitoring, alert triage, log analysis, and incident investigation, supported by SIEM dashboards, custom decoders, and correlation rules.
0xD3F4LT / CYBERSECURITY
Follow the trace.
Find
Yousef Khalaf — Cybersecurity Officer
Strengthening enterprise security through security operations, vulnerability remediation, infrastructure protection, and the evaluation of cybersecurity solutions.
0xD3F4LT
SECURITY · RESEARCH · EDUCATION↓
01 / THE PERSON
From security signals
to actionable insight.
A Cybersecurity Officer with hands-on experience in security operations, vulnerability remediation, and enterprise infrastructure security. I review vulnerability assessment findings across servers and network devices, evaluate affected services and operational risks, and collaborate with Security Operations Center (SOC) teams and infrastructure engineers to prioritize and implement remediation measures. My responsibilities include server security assessments, service updates, security hardening, patch management, and minimizing the attack surface of network services.
My experience in Security Operations Center (SOC) environments includes security monitoring, alert triage, log analysis, incident investigation, SIEM dashboard configuration, custom decoder development, and correlation rule creation. I also review security configurations for management controllers and surveillance systems, assess the operational impact of security changes, and verify the continued availability of critical services following updates.
Beyond vulnerability remediation, I document security findings and recommendations, evaluate cybersecurity solutions against business and technical requirements, and contribute to feasibility studies and procurement specifications.
- SECURITY OPERATIONS
- VULNERABILITY REMEDIATION
- INFRASTRUCTURE SECURITY
- SYSTEM HARDENING
- SECURITY SOLUTIONS
- RISK ASSESSMENT
02 / AREAS OF FOCUS
Detect. Remediate.
Strengthen security.
Practical security operations and infrastructure protection, with risk-based remediation that supports operational continuity.
⌕
Vulnerability remediation
Reviewing assessment findings, evaluating affected services and operational risks, and coordinating remediation priorities with SOC teams and infrastructure engineers.
⌘
Infrastructure security & hardening
Server security assessments, service updates, and secure configurations for servers, management controllers, and surveillance systems to reduce unnecessary exposure.
⚑
Security solutions & technical evaluation
Evaluating cybersecurity solutions, assessing business and technical requirements, and contributing to feasibility studies and procurement specifications.
03 / EXPERIENCE
Experience.
In the field.
Security operations, infrastructure protection, and risk-based remediation—alongside practical training and technical knowledge sharing.
TECHNICAL TOOLKIT
SplunkELK / ElasticsearchOpenCTIMITRE ATT&CKWiresharkNmapPythonLinuxDockerKubernetes fundamentalsRedisRabbitMQMinIOThreat huntingSecurity reportingVulnerability remediationServer hardeningPatch managementRisk assessmentSecurity solution evaluationRFQ preparationActive Directory fundamentalsWindows Server fundamentalsCOBIT fundamentals
Cyber Security Officer
Contribute to strengthening the organization's cybersecurity posture through security operations, vulnerability management, and infrastructure protection. Collaborate with technical teams to assess risks, support remediation, and maintain secure and reliable IT services. Participate in evaluating cybersecurity solutions and developing recommendations that align security needs with business requirements.SOC Analysis Trainer
Freelance
Deliver hands-on SOC training in log analysis, SIEM monitoring, incident detection, and alert triage. Design labs covering PCAP analysis, malware indicators, attack chains, and incident response. Collaborate with ZU, IU, Jordan Cyber Club, and Scalax on customized defensive security programs.SOC Analysis
Scan Wave
Configured SIEM dashboards, custom decoders, and correlation rules. Analyzed alerts and performed incident response using MITRE ATT&CK, with dashboards supporting real-time threat visibility.BTL1 practical training
Tuned Application · Amman
Practical training in security fundamentals, threat intelligence, phishing analysis, and digital forensics, including structured response exercises and forensic investigations.CTF Player & Challenge Author
Multiple first-place competition rankings. Create advanced Digital Forensics, Cryptography, and Misc challenges centered on realistic scenarios and analytical thinking.04 / SELECTED PROJECTS
The case
files.
Security platforms, automation, and analysis tools developed through practical work.
FILE / 001MAR 2026 / THREAT INTELLIGENCEOpenCTI Threat Intelligence Platform
Deployed and configured a Docker-based CTI environment with Elasticsearch, Redis, RabbitMQ, and MinIO. Connected threat feeds including AlienVault OTX and VirusTotal, working with STIX intelligence relationships and indicators.
FILE / 002MAY 2025 / SECURITY SIMULATIONSecureTheSystem
An interactive red/blue team training environment for incident response. Integrated Splunk and MITRE Navigator, with detection rules for SSH brute force, reverse shells, and plugin RCE attacks.
FILE / 003AUG 2025 / SECURITY AUTOMATIONPortScannerXBot
A Python and Nmap Telegram bot for port scanning and service detection. Includes CVE suggestions based on version fingerprinting, GeoIP and WhoIs lookups, with documented API and zero-trust mitigation practices.
FILE / 004AUG 2025 / NETWORK FORENSICSPCAP Network Traffic Analysis Tool
A GUI analysis tool supporting 100+ protocols, including IoT and ICS. Combines packet filtering, protocol search, traffic visualization, suspicious-pattern detection, and file extraction, with PCAP, CSV, and JSON workflows.
05 / RESEARCH & PUBLICATIONS
Research.
Made public.
Research spanning intelligent threat detection and cryptography.
2026 / VOL. 16 · ISSUE 4 · PP. 317–327
LLM-WAF: An Intelligent Web Application Firewall Powered by Large Language Models for Advanced Threat Detection
International Journal of Wireless and Microwave Technologies · Yousef Khalaf
LLM-powered semantic analysis of HTTP traffic, using BERT-based NLP, PyTorch, Hugging Face Transformers, threat scoring, and adaptive learning concepts.DOI: 10.5815/ijwmt.2026.04.18Read publication ↗
2025 / VOL. 17 · ISSUE 4 · PP. 10–19
An Effective Encryption Algorithm Based on RSA and DES
International Journal of Communication Networks and Information Security · Khalaf et al.
Research combining RSA public-key cryptography and DES symmetric encryption, with comparative evaluation of security and computational considerations.Read publication ↗06 / KEEP THE CONNECTION
Curiosity is better
when it's shared.
Let’s connect on security, training, or research.