What Saud demonstrated

Built an end-to-end incident response workflow for a phishing-led intrusion: triaged the email, identified the key indicators of compromise, investigated anomalous authentication activity, mapped events to the cyber kill chain, and chose a defensible containment sequence. Also produced a concise incident report and a GDPR Article 33-style notification, then applied the same reasoning to the public Continental case using the four-week dwell time and ~40 TB exfiltration facts.

• Leakage-Free Threat Triage
• Evidence-Based Log Investigation
• Kill-Chain Mapping and Containment Sequencing
• Executive Security Communication