Ahmed A.

• BUILD: Definition of the strategy and architecture design for collecting data from industrial sites and routing it to the SOC;

• RUN: Implementation of OT detection rules on SPLUNK SIEM + Nozomi Vantage, management of N3 tickets on CORTEX XSOAR, incident investigation. Use of various tools (Crowdstrike EDR, Proofpoint, Zscaler, etc.);

• Fine-tuning: Collaborative work with industrial sites to define OT-specific detection rules.

• Inventory: Mapping of approximately 100 ISIs (industrial information systems) on various airport platforms using Nozomi industrial network probes and other brands;

• Architecture: Creation of architecture diagrams for the mapped ISIs and modeling in a virtualized environment;

• Incident Management: Analysis and investigation of alerts related to IT/OT incidents detected by industrial network probes;

• Operational: Support for the definition/integration of IT services adapted to OT (Bastion solution, log management, protection tools, etc.);

• Cyber-resilience: Assistance in designing a cyber-resilience strategy and actions for IoT;

• PoC: Technical demonstrator for IoT cyber-resilience solutions.

- Cyber Resilience OT: Inventory of OT assets, development of PLC backup script (SOFREL) and procedure, realization of PoC

for PLC hardening, online/offline backup, BCP/DRP, drafting of Cyber OT technical documents;

- Cyber IT: AD remediation, study and implementation of 3-tier architecture, automate backup script, review of Fortigate

and Mikrotik firewall rules, Windows/Linux hardening, Audit and review of architecture and network fl ow diagram,

vulnerability test, writing Windows hardening procedure, deployment of AD audit tool.