Self-service Defender onboarding
A wrapper on a shared folder that let support teams onboard devices, logging who ran it, when and with what rights.
I make sure security controls actually work.
Endpoint security and control assurance specialist. Six years inside a bank operating in seven countries, running SentinelOne, Microsoft Defender and Zscaler through growth, migration and audit. CISM and CIPP/E certified.
Available at short notice. Saudi work visa held; relocating to Riyadh.~18,000assets across seven countries
9SentinelOne consoles run, two on-prem and seven cloud
1stsecurity product the bank moved to the cloud, with regulator sign-off
478unprotected devices found that the console counted as covered
Executive summary
- What I did: ran and migrated endpoint and web security (SentinelOne, Microsoft Defender, Zscaler) for a bank in seven countries, and led security operations on the Darktrace and BigID rollouts.
- What I am known for: proving controls work, not just that agents are installed: a ten-tool reconciliation, a biweekly CISO pack, and signed-off assessments after every rollout.
- Credentials: CISM, CIPP/E, ISO 27001 Lead Auditor, GRCP, and seven Qualys specialist certifications.
- Looking for: endpoint security, security operations, IT controls or GRC roles in the GCC.
Case studies
Work I did at the bank, rebuilt on fictional data.
Endpoint Control Assurance
At the bank I built a workbook by hand that joined ten security tools against the asset inventory, to answer one question: which devices are actually protected? This is that design rebuilt on fictional data, with an interactive dashboard and the ten defects I found and fixed in my original.
Open the case studyAgent present
97.9%
Actually protected
91.3%
Fictional 1,500-device estate.
Post-implementation control assessment
After each rollout (Defender, SentinelOne, Darktrace, Zscaler) I wrote a scoped assessment and a printed checklist where every check had an owner, evidence and a manager's signature. Try the Defender version.
Open the checklist1. Scope it
2. Define each check
3. Evidence every result
4. Judge it
5. Sign it off
2. Define each check
3. Evidence every result
4. Judge it
5. Sign it off
Runbook: agent installed but offline
The step-by-step method I used before escalating EDR cases to the vendor, from name resolution to certificates, with the real incidents that shaped each check.
Walk through the runbook1. Device in use?
2. Name resolves?
3. Port 443 open?
4. Services running?
5. Right console and site?
6. Certificate errors?
7. Escalate with evidence
2. Name resolves?
3. Port 443 open?
4. Services running?
5. Right console and site?
6. Certificate errors?
7. Escalate with evidence
Field tools
Scripts and processes from the day-to-day work, reconstructed with placeholders.
Master agent check
One pass over every security agent on a device: SentinelOne, Defender, Zscaler, Trend Micro, ManageEngine, Forescout, Lansweeper and DLP, with deeper checks where a running service is not proof of protection.
See the script
DSAR erasure workflow
How a deletion request moved from ticket to approval to BigID, and why I closed on a rescan, not a screenshot.
Offline-agent runbook
The seven checks that turned vendor escalations into evidence-backed cases.
Practice labs
Frameworks I have studied and modelled end to end on fictional data, built with AI assistance while preparing for governance and assurance roles. They show how I would structure the work, not experience I am claiming.
PCI DSS operations evidence pack
Evidence register mapped to PCI DSS v4.0.1 across endpoint and malware, vulnerability remediation, access and MFA, logging and incident response. Closest to the audit support I did at the bank.
ISO/IEC 27001:2022 gap analysis
All 93 Annex A controls with a gap matrix, risk register, treatment plan and corrective actions, rolled up into an executive dashboard.
Privacy operations pack
Record of processing activities and a DSAR tracker with statutory deadlines under GDPR and GCC data protection laws.
Security KPI/KRI dashboard model
Executive, operations and risk dashboards covering control coverage, patch latency, vulnerabilities, EDR health and incident SLAs.
Incident RCA, CAPA and POA&M toolkit
Executive reports, timelines, root-cause analysis and corrective actions tracked through to effectiveness checks.
SOC credential access detection lab
Detection rules mapped to MITRE ATT&CK, alert triage notes, false-positive handling and tuning.
Microsoft Purview DLP policy lab
Sample DLP policies with exception workflow, alert triage, governance and a KPI/KRI dashboard.
Six stories I can walk you through
The numbers were falling
Defender onboarding lagged behind target. I split the gap by cause and cleared each list with the team that owned it.
First to the cloud
Won central bank and risk-committee sign-off by answering data retention and deletion questions in writing.
The silent outage
About 450 agents dropped offline on an expired certificate. I renewed it, then made expiry alerts a team responsibility.
Caught in Deep Visibility
A phishing payload tried to switch off antivirus. The device was quarantined before damage was done.
Saying no
I refused a request to keep EDR disabled during a file transfer and explained which controls would catch it.
Finding my own bugs
Rebuilding my workbook, I found ten defects, including drifting lookups. The public version fixes all of them.
Experience
- 2019 – 2025Ahli United Bank, then Kuwait Finance House, Bahrain. Endpoint and information security specialist via First Defense and Gulf Business Machines. SentinelOne administration and cloud migration, Defender PoC and rollout, Zscaler, Darktrace and BigID rollouts, post-implementation assessments, control reporting to the CISO.
- 2018 – 2019Transworld Information Systems. IT security and infrastructure specialist.
- 2014 – 2018SGE Enterprise, Bahrain. Sales and operations manager leading a team of 15.
- 2008 – 2014Zain Telecommunications via ITS. System analyst in the 24/7 monitoring centre: network utilisation, backups and billing runs.
Certifications
CISM, ISACACIPP/E, IAPPISO/IEC 27001 Lead AuditorGRCP and IAIP, OCEG
Qualys Certified Specialist (7): VMDR, EDR, PCI Compliance, TruRisk, CSAM, Cloud Agent and TotalCloud
AI security and governance: Securiti; Anthropic AI Fluency, Claude 101, Claude Platform 101
B.Sc., University of the Punjab, 2007. English (professional), Urdu (native), Arabic (basic).
Contact
mohsin_sharif1@outlook.com
+973 3447 9797 (WhatsApp)
LinkedIn profile GitHub
Download my CV: standard version (PDF) | executive profile (PDF). Versions tailored for security delivery, IT risk or privacy roles are available on request.