SIEM & SOC operations
Data ingestion and analysis, XQL queries, investigations, operational metrics and dashboard design.
Cortex XSIAM · XQL · ElasticsearchCYBERSECURITY ENGINEER
Víctor
Luque Martín.
Security with judgment.
Automation with purpose.
I design cybersecurity solutions and connect platforms, processes and people to turn complex requirements into operations that work.
VÍCTOR LUQUE MARTÍNPALO ALTO NETWORKS
Extended Expertise Consultant
Spain · Saudi ArabiaSIEM / SOAR / XDR / PYTHON / AIPalo Alto Networks · Riyadh, Saudi Arabia
01 / APPROACH
From the requirement
to the solution.
I combine cybersecurity engineering, application development, automation and technical consulting. I use Python and AI to address operational needs and am developing skills and agents to support administrators and security analysts.
Working in Spain and Saudi Arabia has also taught me to solve problems under pressure. During critical escalations involving multiple teams, I bring calm, structure the investigation and explain Cortex behaviour using technical evidence. I test hypotheses, establish the product’s role in the issue and help teams agree on next steps.
Technical judgment
Understand the context and test hypotheses against evidence.
Practical delivery
Turn requirements into applications, playbooks and processes.
Calm under pressure
Structure the investigation and explain decisions clearly.
Shared knowledge
Document, train and support the teams.
02 / EXPERTISE
A connected view
of security.
Engineering, automation and AI for everyday operations. Technical diagnosis to move forward when the pressure rises.
SOAR & automation
Use cases for temporary exceptions, exfiltrated credentials, EDLs and phishing. Playbooks and SOC workflows within teams and across departments.
Cortex XSOAR · Cortex XSIAM · Playbooks · APIsXDR & endpoints
Platform deployment and administration, threat investigation and endpoint protection policies.
Cortex XDR · CrowdStrike FalconAI, applications & agents
AI-assisted application development. Skills and agents currently in development to support administration, investigation and security analysis tasks.
Applied AI · Applications · Skills · AgentsDevelopment & data
Custom tools, applications and data processing to solve operational challenges.
Python · Angular · Machine learningTroubleshooting & problem solving
Incident investigation under pressure, evidence analysis and explanations of Cortex behaviour for technical teams and stakeholders. Coordination to assess causes and agree on actions.
Troubleshooting · Technical evidence · Coordination03 / EXPERIENCE
A career
in evolution.
SPAINSAUDI ARABIA
Extended Expertise Consultant
Riyadh, Saudi ArabiaEngineering and technical consulting in enterprise environments with Cortex XSIAM, XDR and XSOAR.
- Design, deployment, administration and continuous improvement of Cortex platforms.
- Automation use cases, playbooks, integrations and workflows across teams.
- Technical leadership in the migration from XSOAR to XSIAM.
- Critical incident investigation and evidence-based explanations of Cortex behaviour in multi-team discussions.
- Recommendations to improve architecture, processes and security controls.
Cybersecurity Expert
Madrid, SpainSecurity platform operations, tool development and team training.
- Incident management and threat hunting with XQL queries.
- Python and Angular application development and data processing.
- Trained four team members in Cortex XDR; trained and led two in XSOAR.
- Worked with Cortex XSOAR, Cortex XDR, CrowdStrike Falcon and Elasticsearch.
Cyber Threat Analyst
Madrid, SpainFirst-line operations: threat monitoring, incident management and tool development.
- Alert monitoring and ticket management.
- Python tools supporting day-to-day operations.
04 / SELECTED WORK
Real challenges.
Practical solutions.
Engineering, automation and analysis initiatives, from use cases to operational workflows. Client cases are presented without identifying information.
PLATFORM / MIGRATION01
From XSOAR
to XSIAM
Adapting automation and integrations to a new platform while keeping operational processes at the centre.
Cortex XSOARCortex XSIAMSOAR
SOAR / USE CASES02
Automating
SOC operations
Use cases for temporary exceptions, exfiltrated credentials, EDLs and phishing, connected through playbooks and workflows across teams.
PlaybooksIntegrationsWorkflows
SOC / DATA03
Metrics for
better decisions
An operational view connecting assignment and resolution times with the risk of SLA breaches.
XQLDashboardsMTTA / MTTR
AI / ACADEMIC PROJECT04
AI for phishing
and malware
A master’s final project exploring artificial intelligence models to support threat detection.
PythonMachine learningWeb application
05 / EDUCATION
Learning is part
of the work.
Bachelor’s Degree in Computer Engineering
Universitat Oberta de Catalunya
Advanced Master’s in Python for Hacking, Big Data and Machine Learning
EIP International Business School
Master’s in Cybersecurity, Ethical Hacking and Offensive Security
EIP International Business School
Higher Vocational Qualification in Web Application Development
IFP
Credentials & technical training
Credentials and courses from my professional development.
CERTIFICATION
PCAP — Certified Associate Python Programmer
MICROCREDENTIAL
Palo Alto Networks · Cortex XSOAR Consultant
COURSE
Cortex XSOAR 6.2: Automation and Orchestration · EDU-380
WORKSHOP
CPSP Cortex XSOAR Advanced Concepts · PS 201
06 / CONNECT
Good conversations
open new perspectives.
Technology, automation and cybersecurity challenges. If we share professional interests, let’s connect on LinkedIn.
Connect on LinkedIn