What Muhammad demonstrated

Built a complete incident-response workflow for a phishing-led intrusion: triaged the email, identified anomalous authentication activity, extracted actionable IOCs, and sequenced containment to cut attacker access quickly. Also produced a GDPR Article 33 notification and a concise incident report that tied the breach to concrete evidence, including the compromised account, external C2, and likely data exposure.

• Leakage-Free Threat Triage
• Anomalous Authentication Investigation
• Containment Sequencing
• Evidence-Based Security Communication