I build monitoring & defence platforms that help security teams see attacks and stop them.
Senior SIEM & Detection Engineer · AL Rajhi Bank · Riyadh, Saudi Arabia
Open to Cybersecurity Architect and Consultant projects.
The matrix illustrates how detection coverage is tracked against MITRE ATT&CK tactics. It is not any employer's real coverage data.
Riyadh, Saudi Arabia
I'm a Splunk Core Certified Consultant working across the full SIEM lifecycle: architecture and implementation, detection content engineering, security automation, and incident response.
I started in 2013 as a service engineer, moved through every SOC tier from L1 analyst to L3, and now lead SIEM and detection engineering at AL Rajhi Bank. Along the way I've worked with Splunk, ArcSight, Microsoft Sentinel, Google SecOps, and Cortex XSIAM.
7 beyond the day job
Published on Splunkbase. Connects Splunk to vector databases so their contents can be searched with SPL: six databases supported, a three-layer architecture, three collection modes, eight dashboards and eight SPL macros.
Brought detection engineering, SIEM engineering, and 3+ teams onto one approval and reporting workflow, with automated reporting for faster response and clearer cross-team visibility.
An ML-based solution that surfaced unmanaged assets across 100,000+ devices for a 10,000+ employee organization. Presented at an international conference.
Built and manage the Splunk platform behind a bank's security operations: 15,000+ data sources, machine learning for better detection accuracy, and custom Splunk apps.
Started writing at cyberXtrap in 2022 . In 2026 I moved the whole archive onto my own domain vinishjustin.dev
Ran purple team engagements and turned the findings directly into new Splunk correlation searches, then tuned use cases to cut false positives.
Onboarded 10,000+ log sources, built 50+ ArcSight Flex Connectors, and kept an integration tracker covering 5,000+ assets to catch integration issues early.
8 roles since 2013
AL Rajhi Bank · Riyadh, Saudi Arabia · Nov 2023 – Present
SBM · Saudi Arabia · Oct 2021 – Nov 2023
ATOS Paladion · Saudi Arabia · Dec 2017 – Sep 2021
Altisource · India · May 2017 – Dec 2017
Articles per year — 18 in 2023, the busiest
A step-by-step guide to collecting detailed, single-line AIX security logs (logins, su, sudo, executed commands, process activity, cron and binary logs) in /var/log/messages and shipping them to Splunk with the Universal Forwarder, including sample output, Splunk searches and the performance impact.
A step-by-step guide to setting up Ansible: install it, configure passwordless SSH, build an inventory and ansible.cfg, run ad-hoc commands, and upgrade Splunk Forwarders across all your servers with one playbook.
This guide installs a Dashboard Studio page that puts the daily Splunk health checks on one screen. The page covers platform health, indexing and ingestion, license, search and scheduler, infrastructure, clustering, errors and security, and search head cluster bundle replication.
Facing duplicate GUID issue in Splunk forwarders after cloning a VM? Learn how to regenerate the GUID using clone-prep-clear-config and a self-disabling one-shot app, with simple steps for Linux, AIX and Windows.
Open to Cybersecurity Architect and Consultant projects.