Splunk investigation dashboard
Pulls the most useful security data into one view, so analysts stop jumping between searches. Saves the team 4+ hours a day.
New York area · Security operations
Hi, I'm Saer.
I help keep critical systems safe.
Senior Security Analyst with 7+ years in a critical-infrastructure security operations center. I investigate threats, respond to incidents, turn threat intelligence into action, and build automations that give analysts their time back.
- 7+years in security operations
- 4+ hrsa day saved by my Splunk dashboard
- 6certifications, including CEH and CySA+
What I'm doing now
- Mandiant Windows Enterprise Incident Response training
- Building an AI-assisted investigation tool for our analysts
- Mentoring newer analysts on investigations
About
How I got here
I started out building office networks for a startup. On one job I kept finding devices still using their default passwords, and that's what pulled me into security.
In 2019 I joined the security operations center of a large energy utility while it was still small. I often worked shifts alone, so I wrote the investigation procedures and onboarding guides as we grew into a full multi-shift team. Today I handle incidents end to end, hunt for threats and mentor newer analysts. For a long stretch I also hosted a daily call where peer utilities shared what they were seeing.
I'm also the person on the team who asks "can we automate this?" I build tools that cut repetitive work, always with a human checking the important calls.
Experience
Where I've worked
-
2019 – now
Senior Security Analyst
Large energy utility · critical infrastructure · New York
- Own phishing and social-engineering incidents from first alert to closure: indicators, blocks, user notification, password resets and escalation to forensics.
- Investigate email, endpoint and identity threats with Microsoft Sentinel, Defender XDR, Defender for Endpoint and Office 365, Purview and Splunk.
- Hunt proactively with KQL in Sentinel and Defender Advanced Hunting to scope incidents and sweep for indicators.
- Turn threat intelligence into exposure checks. Hosted daily cross-utility intel calls and contributed to E-ISAC.
- Coordinate vendor-compromise investigations and confirm fixes before trust is restored.
- Built a Splunk investigation dashboard that saves analysts 4+ hours a day. Mentor analysts and led onboarding for a team of 3.
-
2018
Cyber Security Contractor
KPMG · Montvale, NJ
- Reviewed application security findings in Fortify and built dashboards to track vulnerabilities across projects.
-
2017 – 2018
Network Engineer
Electric.ai · New York
- Sole on-site engineer for client builds: scoped, designed and deployed secure office networks end to end.
-
2015 – 2017
IT support roles
Telovox · Fordham University · SUNY Polytechnic Institute
-
2016
B.A. Network & Computer Security
SUNY Polytechnic Institute
What I'm good at
Skills I use every day
🚨
Incident response
Phishing and email investigations, endpoint triage, containment, clear communication with users and stakeholders.
🔎
Threat hunting & intel
KQL hunting, indicator sweeps, scoping, and turning intel reports into "are we exposed?" answers.
⚙️
Security automation
n8n, Make, APIs and AI-assisted coding. I design the workflow, then test and secure what gets built.
- Microsoft Sentinel
- Defender XDR
- Defender for Endpoint
- Defender for Office 365
- Purview DLP
- Entra ID
- KQL
- Splunk
- Phantom SOAR
- Exabeam
- Tanium
- MITRE ATT&CK
- NIST CSF
- n8n
- REST APIs
Highlights
Things I've built
Each one is labeled honestly: work, personal project, or still in progress.
AI-assisted investigation tool
My own initiative, now sponsored by management: AI helpers that draft queries, suggest playbooks and find similar cases, with an analyst approving every step.
My personal command center
A one-page dashboard I built to run my week: schedule, top priorities, the health of every automation I run, and alerts when something breaks. It refreshes itself every few hours and works on my phone.
Smart phishing email analyzer
Scans links in reported emails, scores the risk with AI and routes the result to the right ticket and chat channel. It turned hours of triage into minutes, and inspired the work tool above.
Jolof AI
A voice and chat assistant that speaks Wolof, live for real users in Senegal, with monitoring and automatic fallbacks so it fails loudly, not silently.
An online shop that runs itself
Orders from Etsy and Walmart ship automatically through Amazon, tracking flows back, and alerts catch problems the same day.
Certifications & training
Always learning
CEHCertified Ethical Hacker
CySA+CompTIA
Linux+CompTIA
A+CompTIA
PAPAPractical AI Pentest Associate · TCM Security, 2026
GenAI for CyberIBM
Recent training: Mandiant Windows Enterprise Incident Response · Google Cloud Security (Oct 2026) · TCM AI Hacking 101
How I work
Six things I believe
01
Assume it will be attacked
Build for misuse, not just for normal use.
02
Humans approve what matters
Automation suggests. People decide anything consequential.
03
Fail loudly
A tool that breaks quietly is worse than one that raises an alarm.
04
Explain it plainly
Users and leaders should know what happened and what to do next.
05
Let evidence decide
Logs and results beat assumptions.
06
Write it down
Good procedures let the next analyst succeed without me.
Let's talk.
Whether it's a role, a project or a question about security operations, I'm happy to hear from you.