Professional Summary
Cybersecurity researcher and CTI-to-detection practitioner with institutional experience across commercial security engineering (XPLG, enterprise security data platform) and government information security (Israel Police Cyber Defence Unit). I profile adversary behavior, map TTPs to ATT&CK-aligned detection candidates, write hunting hypotheses, and produce structured detection backlog items from raw intelligence. Parallel to institutional roles, I maintain a public research portfolio of 150+ articles, eight Docusaurus field guides, and a library of Python security tools covering malware analysis, CTI engineering, cloud security, and OpenCTI platform operations. AI tooling handles throughput work — collection, enrichment, tagging — with mandatory analyst review at every judgment point.
Employment
Threat Intelligence Research Engineer
XPLG — Enterprise Security Data Platform · Turn Data Into Action™
Tel Aviv District, Israel
- Developing log-based detection use cases by mapping adversary TTPs to available telemetry, parser fields, anomaly detection logic, and SOC investigation workflows.
- Translating threat intelligence findings into actionable detection content and operational guidance for security data teams.
- Bridging CTI research and detection engineering within a commercial security data platform context.
Head of Red Team — Cyber Defence Unit
Israel Police — יחידת הגנת הסייבר
Jerusalem · On-site
- Led offensive security and red-team-oriented research, including adversary behavior analysis, attack simulation, and security validation within a national law-enforcement context.
- Translated offensive tradecraft into defensive outputs: detection ideas, telemetry requirements, investigation paths, and security hardening guidance.
- Produced technical research, hands-on labs, and practical security documentation for defenders and SOC-oriented teams.
Independent Cybersecurity Researcher & Technical Author
Self-employed · Medium portfolio
Israel / Remote
- Maintaining a public cybersecurity research portfolio of 150+ articles and eight Docusaurus field guides focused on turning threat intelligence into practical defensive outcomes.
- Publishing evidence-labeled CTI assessments, ATT&CK mapping, attack-chain reconstruction, adversary emulation labs, detection engineering logic, and SIEM/logging guidance.
- Research topics include CTI-led defensive strategy, APT-style kill chain analysis, Kubernetes and cloud-native threat landscapes, AI-assisted offensive security, and red-team simulations with defender-oriented logging lessons.
Security Tools Developer
Self-employed
Israel · Remote
- Building practical tools for cybersecurity automation, investigation, detection engineering, malware and static analysis, and security lab workflows.
- Tools cover log analysis, IOC enrichment, file inspection, threat research, detection validation, and repeatable security experiments.
- Primary languages: Python, Bash, C/C++, JavaScript.
Prior Service
Special Forces Paramedic-Fighter
Israel Ministry of Public Security · Full-time
7 yr 5 mos
Paramedic
Magen David Adom · Full-time
4 yr 9 mos
Skills & Tools
CTI & Threat Intelligence
- CTI assessments and actor profiling
- Attribution methodology & confidence language
- Infrastructure pivoting (passive DNS, TLS, ASN, WHOIS)
- ATT&CK mapping & gap analysis
- PIR / SIR development
- Kill chain analysis
- Threat actor profiling & OSINT
- Source reliability frameworks
Detection Engineering
- Hunting hypothesis development
- Sigma-compatible detection rules
- Atomic and correlation-based detection
- Log source and telemetry mapping
- SIEM / XDR detection logic
- YARA rule development
- Detection handoff reporting
- Detection backlog management
Platforms & Tooling
- OpenCTI (operations, connectors, STIX workflows)
- MITRE ATT&CK Navigator
- VirusTotal, Shodan, passive DNS tools
- CVSS v4.0 scoring & prioritization
- CVSS-BTE, KEV, EPSS
- Frida dynamic instrumentation
- Terraform, Kubernetes
Malware Analysis
- Static PE analysis (imports, strings, FLIRT)
- Android APK static analysis
- YARA rule generation from samples
- Frida-based dynamic analysis
- CFG analysis & unpacking detection
- Import table & string triage
- Candidate ATT&CK mapping from behavior
Programming & Automation
- Python (primary — analysis, automation, tooling)
- Bash scripting
- C / C++ (malware analysis context)
- JavaScript
- AI-assisted analysis workflows
- Multi-LLM routing and model orchestration
Cloud & Infrastructure
- Kubernetes threat research & detection
- AWS and GCP security posture
- Terraform lab environments
- Container and cloud-native attack paths
- Audit log analysis and detection
- Cloud misconfiguration research
Contact
Get in touch
Email is the fastest way to reach me. LinkedIn is best for professional context.
Portfolio
The main portfolio page lists flagships, review paths, articles, tools, and Docusaurus documentation sites.