Ahmad Musyaffa'

SOC Analyst L1

PT Aplikanusa Lintasarta

• Monitoring, collecting, and escalating security events from LogRhythm SIEM, correlating findings against MITRE ATT&CK framework to accurately classify and prioritize threats.
• Executing malicious IP/Domain blocking on Fortigate and PaloAlto firewalls, and performing reputation analysis on IPs and file hashes using VirusTotal, AbuseIPDB, OTX AlienVault, and CrowdStrike as Threat Intelligence platforms.
• Managing EDR (ESET) and XDR (Trend Micro, Microsoft Defender) platforms for continuous monitoring, detection, and response across endpoints and enterprise environments; currently transitioning to Cisco XDR.
• Conducting threat analysis using Google Threat Intelligence (enterprise) to investigate and contextualize emerging threats.
• Performing Threat Hunting based on active Threat Actor intelligence, leveraging the Cyber Kill Chain methodology to map adversary behaviors and uncover hidden indicators of compromise.
• Authoring Security Advisory reports covering CVE trend analysis, including executive summaries, impacted systems, IOCs, and actionable mitigation recommendations with threat mapping aligned to MITRE ATT&CK and Cyber Kill Chain.
• Producing Security Awareness Bulletins to educate stakeholders on active threats such as phishing campaigns and social engineering tactics.
• Independently developing A.E.G.I.S, an AI-powered Security Platform integrated with Gemini AI and multiple Threat Intelligence platforms, with MITRE ATT&CK correlation embedded to streamline advisory analysis and publication workflows.
• Building AI-driven automation pipelines to accelerate security report generation and reduce manual effort across SOC operations.
• Managing security incidents end-to-end via ServiceNow ticketing system, ensuring compliance with SLA standards across all severity levels (Low to Critical).
• Operating on a 24/7 shift-based schedule, maintaining consistent coverage and rapid response across all time windows.