Mohsin Ashraf

About

I build the security infrastructure that lets organizations operate with confidence.

With a Master's in Information Security from NUST and hands-on experience across four countries, I specialize in turning raw log telemetry into actionable intelligence. My work spans the full lifecycle, from architecting Elastic and Wazuh SIEM platforms, to operationalizing CrowdStrike Falcon EDR, to building automated response workflows that cut incident containment from hours to seconds.

I've led SOC teams, authored detection rules mapped to MITRE ATT&CK, and delivered security platforms for government ministries, national immigration systems, universities, and tier-1 telecom carriers. Every deployment I touch ships with tuned alerts, clean dashboards, and documentation that makes handover seamless.

What I Do

Core Expertise

Depth in the areas that matter most for modern security operations.

SIEM & XDR Architecture

End-to-end platform design, log ingestion pipelines, ECS normalization, and tailored analyst dashboards built for scale.

Elastic Security Wazuh Logstash Kibana KQL

EDR & Endpoint Operations

Managing enterprise endpoint protection, from alert triage and threat hunting to containment workflows and root-cause forensics.

CrowdStrike Falcon Microsoft Defender Threat Hunting

Detection Engineering

Writing high-fidelity correlation rules mapped to MITRE ATT&CK to catch real threats and silence false-positive noise.

MITRE ATT&CK Sigma Rules Custom Decoders YARA

SOAR & Automation

Building automated playbooks for enrichment, deduplication, and instant threat mitigation, letting security analysts focus on critical incidents.

TheHive Cortex DFIR-IRIS n8n Python

Vulnerability Assessment

Comprehensive scanning, risk evaluation, and remediation guidance aligned to ISO 27001 and industry best practices.

OpenVAS Nmap Wireshark Kali Linux ISO 27001

Digital Forensics & Incident Response

Certified forensic investigator skilled in evidence acquisition, disk and memory analysis, malware triage, and post-breach investigation reporting.

CHFI Forensic Analysis Malware Triage IR Reporting

Selected Work

Enterprise Deployments

Security platforms I've architected and delivered for government, telecom, and enterprise clients.

Malaysia Government

Ministry of Transport

SIEM & XDR Platform · SOC Operations

Designed and deployed a full SIEM/XDR platform for the national transport ministry. Onboarded Windows, Linux, firewall, and network telemetry with MITRE ATT&CK-mapped detection rules and executive dashboards.

Impact: Real-time threat visibility across critical national transit infrastructure.

SIEM/XDR MITRE ATT&CK Firewall Ingestion

Malaysia National Security

Visa & Immigration Authority

End-to-End SIEM · Managed EDR

Built a complete SIEM and XDR solution for a national visa and immigration system with managed endpoint agents, custom detection rules, and incident response workflows.

Impact: Accelerated endpoint threat containment with high-fidelity triage procedures.

Endpoint Security Detection Tuning Incident Response

United Arab Emirates MSSP

Depth Defense

XDR & SOAR · Automated Response

Integrated XDR with SOAR platforms to build automated containment playbooks, enabling instant endpoint isolation and drastically reducing Mean Time to Respond.

Impact: Threat response time reduced from hours to seconds with automated playbooks.

TheHive Cortex Automated Isolation

Pakistan Telecom

Redtone Telecom

24/7 SOC · SIEM/XDR Deployment

Provided round-the-clock SOC operations and deployed a SIEM/XDR platform for a tier-1 national telecom carrier, monitoring critical infrastructure nodes against volumetric and targeted attacks.

Impact: Uninterrupted 24/7 monitoring protecting core telecom infrastructure.

Telecom SOC Network Flow Detection Engineering

Saudi Arabia Enterprise

Optiva

SIEM/XDR · Telemetry Unification

Unified endpoint, server, and network telemetry into a single monitoring platform with automated alert triage and threat intelligence enrichment.

Impact: Consolidated multi-source telemetry into a single-pane-of-glass security view.

Elasticsearch Alert Triage Threat Intel

Pakistan Enterprise

FPCDL

SIEM/XDR Deployment · Device Integration · SOC Training

Delivered a complete SIEM/XDR solution including full platform deployment, security devices integration, endpoint onboarding across the organization, and hands-on training for the in-house SOC team.

Impact: Fully operational security monitoring with a trained SOC team capable of independent threat detection and response.

SIEM/XDR Device Integration Endpoint Onboarding SOC Training

Malaysia Education

University of Malaya

SIEM · Log Pipelines · Dashboards

Architected high-throughput log ingestion pipelines, normalized heterogeneous log sources into Elastic Common Schema, and built role-based security monitoring dashboards.

Impact: Scalable pipeline processing millions of daily events with zero data loss.

Logstash ECS Kibana Dashboards

Career

Professional Experience

Senior Security Expert / Team Lead

IOTA Solutions · Islamabad, Pakistan

Feb 2025 – Present

Lead and direct the security operations team across multiple client engagements, managing investigation priorities and critical incident escalation.
Architect and deploy customer-specific SIEM/XDR platforms from initial scoping through operational handover.
Design detection rules, build correlation logic, and oversee CrowdStrike EDR alert workflows and endpoint containment.
Conduct vulnerability assessments and advise enterprise clients on risk remediation and compliance readiness.

Cybersecurity Engineer

Etika Info Sdn Bhd · Kuala Lumpur, Malaysia

Jul 2023 – Feb 2025

Analyzed security events across SIEM/XDR platforms and produced technical root-cause investigation reports.
Operationalized CrowdStrike Falcon EDR, designing response playbooks and integrating endpoint telemetry into SOC workflows.
Fine-tuned correlation rules and custom decoders to maximize detection accuracy and reduce alert fatigue.
Performed external and internal vulnerability assessments using OpenVAS, Nmap, and Kali Linux tooling.

Consultant, Security Operations

IOTA Solutions · Pakistan

Aug 2021 – Dec 2023

Administered and optimized SIEM solutions, firewall appliances, and log aggregation infrastructure.
Analyzed network flow data and coordinated rapid containment of identified malicious indicators.
Received the Best Performance Award for exceptional service delivery and platform stability.

Credentials

Certifications & Education

CEH v13

Certified Ethical Hacker · EC-Council

CHFI

Computer Hacking Forensic Investigator · EC-Council

ISO 27001:2022

Lead Auditor · Mastermind

CrowdStrike Falcon Hunter

Certified · CrowdStrike University

AWS Cloud Practitioner

Certified · Amazon Web Services

ISC2 CC

Certified in Cybersecurity

CNSP

Network Security Practitioner

Barracuda WAF

WAF01 Foundation Certified

Google Professional

Python · Cybersecurity Foundations

Best Performance Award

IOTA Solutions

Master's in Information Security

NUST (National University of Sciences & Technology)

CGPA 3.5 / 4.0 2021 – 2024

Thesis: Investigation of Security-Related Routing Issues in IoT Networks. Coursework in Network Security, Cryptography, Cloud Security, and Vulnerability Exploitation.

BS Computer Systems Engineering

Bahauddin Zakariya University (BZU), Multan

CGPA 3.85 / 4.0 2017 – 2021

Comprehensive foundation in Computer Architecture, Operating Systems, Networking, Data Structures, and Applied Network Defense.

Senior Security Engineer