Algoma University
Master of Science, Computer Science
Co-authored IEEE/ACIS SNPD 2025 research on controlled ransomware for security education.
// hello, world. I'm
Ahmed Sartaj
Cybersecurity IT Support Network & Systems Administration
I detect, investigate and contain threats in enterprise environments, and I keep the infrastructure underneath them running.
- 3+ yrsMSSP SOC experience
- 100+ATT&CK-mapped detections
- 80%fewer false positives
- 3,400+users protected
Experience
Cybersecurity
IT Support / Network / SysAdmin
-
Service Advisor (IT & Technical Support)
IT Support- Handle 40+ support cases a week: ticketing, troubleshooting, hardware and software diagnostics, and escalation.
- Raised the resolution rate by 25% and cut average resolution time by 20% through disciplined ticket lifecycle management.
- Explain technical findings and recommendations clearly to non-technical customers and stakeholders.
-
Cybersecurity Analyst / Security Engineer
Cybersecurity- Triaged and investigated 60+ daily alerts across Microsoft Sentinel, IBM QRadar, Splunk, CrowdStrike Falcon and Defender for 3,400+ users, meeting 30–60 minute SLAs in a 24/7 SOC.
- Engineered 100+ MITRE ATT&CK-mapped detections in KQL, AQL and SPL, cutting false-positive escalations by 80% and breach exposure by 70%.
- Led incident response and digital forensics engagements end to end, from containment through root cause analysis and post-incident reporting.
- Automated IOC enrichment, triage and log parsing with Python, PowerShell and Bash, reducing manual investigation effort by 35%.
-
Associate Cybersecurity Analyst / Junior Security Engineer
Cybersecurity SysAdmin- Monitored SIEM platforms, triaged Tier 1 alerts, and escalated incidents with full investigation context and IOCs.
- Administered Active Directory, Microsoft 365 and endpoint protection across client onboarding and offboarding.
- Supported vulnerability scan analysis, IOC enrichment and detection tuning.
- Wrote Python and PowerShell scripts for log parsing, account auditing and configuration comparison.
Education
NED University of Engineering and Technology
Bachelor of Engineering, Computer Systems
Skills
Cybersecurity
- Microsoft Sentinel (KQL)
- IBM QRadar (AQL)
- Splunk (SPL)
- CrowdStrike Falcon
- Defender for Endpoint
- Incident Response
- Digital Forensics (CHFI)
- Threat Hunting & CTI
- MITRE ATT&CK
- Detection Engineering
- Vulnerability Management
- AWS & Azure Security
- IAM / Entra ID / PIM
- SAST / DAST Analysis
- NIST CSF · ISO 27001 · PCI DSS · SOC 2
IT Support / Network / SysAdmin
- Active Directory & GPO
- Microsoft 365
- Windows Server 2016–2022
- Linux (Ubuntu, RHEL, CentOS)
- Fortinet FortiGate
- Cisco ASA / FTD
- TCP/IP, DNS, DHCP
- VLANs & Segmentation
- VPN (IPsec, SSL, WireGuard)
- Wireshark / tcpdump
- Python · PowerShell · Bash
- Docker
- ITIL Incident & Change
- Troubleshooting & Ticketing
Projects
Controlled Ransomware Framework
Educational, safety-bounded ransomware simulator inspired by WannaCry, built for desktop (Python crypto APIs) and Android (Flutter/Dart). Published at IEEE/ACIS SNPD 2025.
- Python
- Flutter / Dart
- RSA / AES
MITRE ATT&CK Detection Program
100+ detection rules across Sentinel, QRadar and Splunk covering initial access, lateral movement, privilege escalation and exfiltration, with an 80% drop in false positives.
- KQL
- AQL
- SPL
- ATT&CK
SecOps Automation Toolkit
Scripts for IOC enrichment, alert triage, detection rule generation, log parsing and SOAR integration. They cut manual investigation overhead by 35%.
- Python
- PowerShell
- Bash
- REST APIs
Cloud Security Posture Assessments
Assessed AWS and Azure environments against CIS Benchmarks. Configured GuardDuty, Security Hub, Defender for Cloud and Conditional Access, and coordinated remediation.
- AWS
- Azure
- CIS
- CSPM
Incident Response Playbooks
NIST-aligned playbooks for phishing, malware, lateral movement, credential compromise, cloud misconfiguration and data exfiltration.
- NIST CSF
- DFIR
- SOAR
Threat Intel & Hunting
Multi-source CTI collection and IOC enrichment, plus proactive hunts across enterprise environments, with threat assessments shared with clients.
- CTI
- IOCs
- STIX/TAXII
Awards & Recognition
Top Performer · awarded twice
Quarterly Best Performer: "Mr. Dependable"
Recognized in consecutive quarters for taking ownership of multiple client environments and handling a wide range of security tasks with commitment and reliability.
View LinkedIn post ↗
Co-Authored Publication
Design and Implementation of a Controlled Ransomware Framework for Educational Purposes Using Flutter Cryptographic APIs on Desktop PCs and Android Devices
A WannaCry-inspired, safety-bounded framework that lets students study ransomware behaviour safely. Encryption is confined to a single directory and limited file types, and the decryption key is provided up front.
Certifications
IBM Certified Analyst: Security QRadar SIEM V7.4.3
Verify on Credly ↗
CHFI: Computer Hacking Forensic Investigator
Verify on EC-Council Aspen ↗
AWS Certified Solutions Architect – Associate
Verify on Credly ↗
CCNA: Introduction to Networks
Verify on Credly ↗
ISC2 Candidate
Verify on Credly ↗Training & Courses
- Career Essentials in System Administration
- Prepare for the AWS Certified Machine Learning – Specialty (MLS-C01)
- Enterprise Security Fundamentals
- SOC Core Skills with John Strand (16 hours)
- PCAP: Programming Essentials in Python
- CCNA Routing and Switching: Routing and Switching Essentials
- CompTIA Security+ and Network+
Currently Learning
-
Developing scripts for Cybersecurityin progress
Python and PowerShell tooling for IOC enrichment, triage and detection-as-code.
-
Learning SC-300, IAM, Container Securityin progress
Microsoft SC-300 (Identity & Access Administrator), CyberArk Sentry / PAM Defender, Docker & Kubernetes security.
-
Digital Forensicscurrently exploring
Going deeper after CHFI: memory and disk forensics, timeline reconstruction.
-
AWS Certified Security – Specialtyup next
Testimonials
Loading testimonials…
Get in Touch
I'm open to SOC, incident response, detection engineering, cloud security and IAM roles in the Greater Toronto Area or remote. Send a message and it lands straight in my inbox.
Based in Mississauga, ON