~/ali

Security engineer · Chicago, IL

Ali Alshaheen

I build detections, secure cloud identity, and automate the parts of security operations that shouldn't need a human at 3am. Currently focused on Microsoft Sentinel, Defender XDR, and Entra ID.

Detection & response Entra ID KQL Automation
Portfolio → Experience, projects, certifications, and the work behind them. Writing → Detection engineering notes, KQL, Sentinel, and identity attack paths. Travel → Every country, one at a time. An interactive globe of where I have been and where I am going next. Get in touch → Open to conversations about detection engineering and cloud security roles.

Latest writing

All posts →

Don't take AZ-500. Take SC-500.

AZ-500 retires August 31, 2026 — including the renewal assessment. What's changing, what carries over to SC-500, and what to do depending on whether you're mid-study or already certified.

9 min read

First Post!

This is Just a Test !!

1 min read

Credentials

MS, CybersecurityWGU
BS, Computer ScienceUIC
CySA+ · PenTest+CompTIA
Cloud PractitionerAWS