Omri Degani

Detection engineering for a 5,000-person global manufacturer (~5,000 endpoints, 2,000 servers, 7 US/Canada sites; corporate IT plus monitored OT). Authored 200+ detection rules from scratch across Cortex XSIAM, XDR, Microsoft Sentinel, Defender for Endpoint and CrowdStrike Falcon, each mapped to MITRE ATT&CK. Led the enterprise migration onto Cortex XSIAM and owned log-source strategy under SaaS ingestion constraints. Drove tuning that cut the false-positive rate from ~50% to ~15%, built the SOAR automation layer in Python and PowerShell, and act as final in-region escalation authority.

Led SOC operations for an MSSP with a team of 7-10 analysts across multiple concurrent client environments — owning shift structure, monitoring coverage and queue management. Established incident escalation protocols and triage standards, served as escalation authority on complex incidents, and prioritised vulnerability management across client estates.

Triaged and escalated confirmed incidents with supporting investigative analysis across multiple MSSP client estates. Analysed network traffic and endpoint logs to identify anomalous activity, investigated incidents to root cause, and tuned alert configurations to improve signal quality and reduce low-value volume.

Delivered managed IT across multiple on-prem and hybrid client environments: Windows Server, Active Directory, DNS/DHCP, Hyper-V and VMware, Microsoft 365 and Exchange. Managed perimeter security (FortiGate and Check Point firewalls, SSL-VPN, endpoint protection, Group Policy) and backup/replication infrastructure, automating recurring tasks with PowerShell.