نموذج سيرة ذاتية لوظيفة التحليل الجنائي الرقمي (DFIR)

DFIR challenge write-ups (github.com/casey-example/dfir-writeups)

• Published 15 write-ups of memory and disk challenges, each with the commands, the timeline and the indicators found, tagged with MITRE ATT&CK techniques
• Used Volatility to find an injected process in 3 memory images and traced each one to its parent process

Incident timeline template (github.com/casey-example/timeline)

• Built a timeline sheet that merges event logs, browser history and file times, and tested it on 4 lab incidents
• Wrote a Python script that merges the exported logs into one sorted table and removes the duplicate rows

SOC Intern, Example Managed Security

Jun 2024 - Present

• Collected evidence from 8 Windows endpoints with Velociraptor after confirmed alerts and handed it to the senior analyst
• Wrote 10 incident timelines in the case tool, each reviewed and signed off by a Tier 2 analyst
• Imaged 3 laptop disks with FTK Imager and checked each hash before and after the copy
• Documented the evidence handling steps so every handover recorded who held the data and when