Sarah AlJaber
Senior Incident Response Consultant
Bank Alinma
I'm a Senior Incident Response Consultant and DFIR specialist, leading enterprise investigations, compromise assessments, and threat hunting across the region. I hold the GIAC GEIR and GCIH certifications and specialize in detection engineering, SOC maturity assessments, and SIEM/EDR development. A prior Black Hat MEA speaker, I founded Hack The Logs, a log-baseline documentation platform aligned with Saudi NCA and NIST standards. I'm currently pursuing an MBA alongside my security work.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Your SOC Is Measuring the Wrong Things: Stop Counting Alerts. Start Measuring Confidence.
Most Security Operations Centers are drowning in telemetry and starving for answers. We ingest more logs, deploy more detection rules, and close more alerts every year yet when leadership asks the only question that matters, "are we actually protected against the threats that matter to us?", we can't answer with evidence. This session argues the problem isn't a shortage of data or tools. It's an operating model built to notice alerts instead of to prove outcomes.I'll present a practical, tool-agnostic framework for running the SOC as a capability rather than an alert factory. We'll cover the distinction between telemetry and real security visibility; how to engineer visibility backward from business risk and security questions rather than collecting more data; why detection coverage on paper isn't coverage until it's validated; and how to measure the SOC through outcome-driven OKRs instead of vanity KPIs.The framework connects scoping and threat profiling, visibility engineering, detection engineering, adversarial validation, and continuous improvement into one repeatable loop each stage producing evidence you can audit. Grounded in real incident-response experience and current research, this is a methodology SOC leaders and practitioners can start applying to a single crown-jewel risk on Monday morning. You'll leave able to prove what your SOC can, and cannot, detect.
- 13:30
- Wed
- 02 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote