Karim Abdel‑Nasser
I design and defend systems where trust is never assumed. SOC analyst, detection engineer, and storyteller of incident response.
See the work →Who Am I
I'm a SOC analyst and computer science student based in Cairo, living at the intersection of detection engineering and human instinct. I build security environments that don't just catch threats — they tell a story about how the breach happened, and how to stop it from happening again.
My work is not about collecting alerts. It's about understanding the rhythm of infrastructure, the anomalies that feel wrong, and the automation that gives analysts back their time. Every lab I build, every rule I write, is an invitation to think like an adversary — and then think better.
Education
Experience
Designing and deploying enterprise‑grade security labs: Zero Trust Architecture, Linux IAM with FreeIPA/Keycloak/Vault, and a full SOC investigation series. Each environment is documented, reproducible, and built to train analysts in real‑world detection and response.
Services
Projects
Dual‑site Zero Trust Architecture Lab
Two physical machines, four VLANs, IKEv2 IPsec tunnel, Suricata IDS, Splunk telemetry pipeline, and a Cloudflare‑wrapped access layer with Traefik + Authelia MFA. The lab validates that trust must never be implicit — not even between sites.
Linux Identity & Access Management Lab
Five VMs, FreeIPA for LDAP/Kerberos, Keycloak for OIDC federation, HashiCorp Vault for PKI/secrets, and ELK for audit trails. A complete, production‑style IAM environment built to understand identity as the new perimeter.
SOC Investigation Lab
Ten real‑world scenarios: phishing analysis, lateral movement hunting, memory forensics, and detection rule writing. Each lab produces a report, a rule, and a script — built to train analysts in the art of the hunt.
IOC Enrichment Tool (Python)
A command‑line tool that queries VirusTotal and AbuseIPDB in parallel, reduces enrichment time from minutes to seconds, and outputs structured CSV reports ready for ticket ingestion.
Blog
Deep dives into zero trust, detection engineering, and the human side of incident response.