XPLG — Enterprise Security Data Platform · Tel Aviv, Israel

• Maps adversary TTPs (Iran-nexus campaigns, hacktivist clusters, cloud-native threats) to XPLG platform telemetry fields; produces log-based detection use cases covering endpoint, network, and cloud audit log sources.
• Translates CTI assessments into Sigma-compatible detection content, hunting hypotheses, and analyst-ready investigation guides scoped to enterprise SIEM and XDR deployment contexts.
• Builds and documents CTI enrichment workflows covering parser field mapping, anomaly detection logic, and structured threat reporting pipelines for security operations teams.

Israel Police — יחידת הגנת הסייבר · Jerusalem, On-site

• Directed red-team assessments against national law-enforcement infrastructure: reconnaissance, vulnerability chaining, privilege escalation, lateral movement, and attack-path validation in sensitive operational environments.
• Converted offensive findings into structured defensive intelligence: detection hypotheses mapped to observed attacker behavior, telemetry coverage gap analysis, hardening recommendations, and incident response runbooks.
• Produced adversary behavior research and hands-on lab environments used by blue team and SOC personnel for detection development and threat hunting training.

Self-employed · Israel, Remote

• Published 150+ articles on CTI tradecraft, detection engineering, malware analysis, cloud security, and security tooling — covering actor-level threat research, detection methodology, and operational tool walkthroughs.
• Shipped 10+ open-source tools on GitHub including AIDebug, stratus-ai, cvss_4.0, Static Malware Orchestrator, Android Malware Analysis, and PE-Import-Analyzer.
• Maintains 8 Docusaurus knowledge bases: CTI Analyst Field Manual, Israel Gov Threat Actors CTI, Customer-Driven AI CTI Project, OpenCTI Intelligent Shield, and CVSS v4.0 Field Guide.