Ahmed Sajid Butt

I'm a Computer Science graduate (Bahria University Lahore, 2025) focused on Security Operations: SOC monitoring, threat detection, and incident response.

Most recently, I worked on Threat Detection and SOC Research at CNS Engineering, where I ran hands on Microsoft Defender XDR work: MITRE ATT&CK mapped attack simulations, KQL threat hunting in Advanced Hunting, a full ransomware investigation traced end to end, and Defender for Endpoint onboarding across GPO and Intune. I authored formal deliverables including a Threat Hunt Report, Incident Forensics Report, and Ransomware Investigation Runbook.

To keep building hands on skills between roles, I built Vigil, a self hosted SOC detection lab where I wrote custom Wazuh detection rules from scratch (signature based and frequency correlation), simulated a full four stage attack chain mapped to MITRE ATT&CK, and built a working Wazuh to TheHive integration so detected alerts automatically escalate into a case management workflow. Full writeup and detection logic documented on GitHub.

I also hold KC7 Security Analyst I and Security Analyst II certifications and built Sentinel Forge, an earlier detection lab on ELK Stack with custom Kib