Freelancer profile translated to English.

Description

More than 11 years of experience in information security consulting with a specialization in incident response through SOC - CSIRT activities.

I am:

- Rigorous

- Able to demonstrate autonomy

- A good team player

- Looking for a new challenge

Languages

English
Fluent
Chinese
Native or bilingual

Workplace preferences

Can work on-site

Paris (up to 20km), Paris (up to 30km)

LVMH
Cybersecurity Consultant
LUXURY GOODS
July 2022 - Today (4 years)
Paris, France
In charge of building an in-house SOC for Dior Couture with Splunk, Akamai, SentinelOne, Bitsight, Xpanse, Varonis, Wiz, ProofPoint solutions

Build Activity:
- Define a log collection and detection strategy
- Coordinate the deployment of EDR agents
- Build and monitor actions with the MSSP (Managed Security Service Provider)
- Writing documents (Workflow, process, RACI…)
- Build and manage the SOC/CSIRT team
- Define and integrate attack scenarios

Run Activity:
- Security incident management
- Vulnerability monitoring
- Coordination of action plans with external and internal teams
- Reporting
- Continuous improvement
IDEMIA
SOC MANAGER
TECH
January 2022 - July 2022 (7 months)
Paris, France
In charge of setting up an XDR platform via the deployment of EDR and SIEM components (Tehtris)
In charge of building and organizing a CSIRT team

Build Phase:
- Define an architecture for SOC components (SIEM, forwarder…)
- Coordinate the deployment of EDR agents
- Build and monitor actions with the MSSP (Managed Security Service Provider)
- Writing documents (Workflow, process, RACI…)
- Build and manage the SOC/CSIRT team
- Define and integrate attack scenarios

Run Phase:
- Security incident management
- Vulnerability monitoring
- Coordination of action plans with external and internal teams
- Reporting
- Continuous improvement
THETRIS
Thales Digital Factory
SOC Architect
TECH
July 2020 - December 2021 (1 year and 6 months)
Tech Lead in charge of setting up a DR SOC (AGILE collaboration)
Build Phase:
- Define an architecture for SOC components (IDS probes, SIEM, Antivirus…)
- Writing documents (LLD, operations, MCO/MCS…)
- Study and integration of a SIEM solution (Splunk Enterprise Security)
- Study and integration of Trend Micro antivirus solutions (Deep Security & Apex One)
- Define and integrate attack scenarios
RUN Phase:
- MCO of SOC components
- Security incident management
- Forensics Investigation
- Coordination of action plans with external and internal teams
- Continuous improvement