Mansour Jalaly

Detection engineering and incident response for Oracle Cloud Infrastructure, owning ML-assisted detection development across high-volume telemetry.

Detection engineering

Designed and own ML-assisted detection models for OCI, improving true-positive accuracy by ~30% and cutting false positives by 75%, while expanding visibility through optimised log pipelines, IAM policies, and event routing.

Detection as code

Maintain Sigma rules in Git with automated testing in CI/CD, mapped to MITRE ATT&CK for coverage tracking.

Response & automation

Lead investigations across cloud and endpoint environments and engineered SOAR playbooks for triage, enrichment, and escalation — improving mean time to detect by ~60%.

Intelligence & governance

Integrated threat-intelligence feeds into detection pipelines, run ATT&CK-aligned hunts that close coverage gaps, and deliver NIST/ISO 27001-aligned risk reviews and executive incident reporting.

DFIR and security consulting for client environments ranging from SMEs to large enterprises.

DFIR

Led ransomware, BEC, insider-threat, and cloud-intrusion investigations; conducted endpoint, malware, and network/cloud forensics with chain-of-custody, delivering containment guidance that reduced client downtime.

Threat intelligence

Produced ATT&CK-aligned threat assessments and adversary behaviour analysis that directly strengthened client detection and response posture.

Security consulting

Implemented and tuned EDR, SIEM, and IDS deployments; advised on IAM, Windows administration, virtualisation, and secure remote access.

Communication

Briefed client leadership during live incidents; post-incident documentation drove long-term remediation roadmaps.

Problem

Detection content is only ever as good as the last attacker who tested it, and human red teams are expensive and episodic — leaving the lab idle and coverage gaps unmeasured between engagements.

Contribution

Built a local, air-gapped experiment running two AI agent crews against each other: a red crew that plans and executes scoped attack behaviour, and a blue crew that triages the resulting telemetry and proposes detections. Runs entirely on local hardware (CrewAI orchestration, Ollama-served models, ChromaDB for RAG) as a glass box — every plan, tool call, and decision logged and human-reviewed.

Outcome

A continuously refreshed gap list of techniques the detection stack failed to see, generated at a cadence no human red team could sustain — with every proposed rule landing in a human review queue, never straight to production.

Problem

Validating detection logic against realistic attack traffic is difficult without a representative environment — production telemetry is noisy and tightly controlled.

Contribution

Built a Terraform-provisioned hybrid lab simulating enterprise infrastructure, with Zeek and Suricata telemetry feeding ML models (Random Forest, Isolation Forest) trained on PCAP datasets, MISP for threat-intel correlation, and OCI for compute-heavy analytics. Fully containerised for reproducibility.

Outcome

An end-to-end testbed for validating detections before they ship — now expanding into unsupervised anomaly detection and cloud-native SIEM pipelines.

Problem

Home and small-office networks rarely have any detection capability, and commercial NIDS options are over-specified for the footprint.

Contribution

Designed and deployed a Raspberry Pi-based NIDS for real-time network monitoring, shipping Snort alerts via Filebeat to a self-hosted Elastic SIEM with Kibana dashboards — covering hardware selection, configuration, and detection tuning end-to-end.

Outcome

Continuous, low-cost network visibility with tuned signatures and dashboards — and a working reference for SME-scale detection architecture.

Problem

Signature-based host IDS misses novel exploitation; anomaly detection on system-call behaviour offers a path to catching unknown attacks.

Contribution

Built an anomaly-based IDS for UNIX systems, parsing system calls captured via strace/ptrace into training datasets and applying a probabilistic detection model. Supervised by Prof. Lorenzo Cavallaro, Chair of Cybersecurity at KCL.

Outcome

Successfully identified a stack-based buffer overflow on an Ubuntu i386 target from system-call behaviour alone.