About Ali Alshaheen
IT Security Associate — Level 2 · Chicago, IL
IT security engineer focused on detection & response, Microsoft Sentinel, and cloud identity.
I'm Ali Alshaheen — a security engineer based in Chicago, IL, working in detection and response with a focus on the Microsoft stack: Sentinel, Defender XDR, and Entra ID. Most of what I do day to day is turning adversary behaviour into detection logic that holds up in production, and automating the parts of response that shouldn't need a human at 3am.
What this blog is
Working notes, published in public. When I figure something out — a detection that took three rewrites to stop firing on noise, an identity attack path that isn't documented well anywhere, a KQL query that finally scaled — it gets written up here.
Everything is tested in a lab before it's published. If a detection is here, I ran the attack, watched the telemetry, and validated the rule. Where I'm unsure, I say so.
What I write about
- Detection engineering — rule design, testing, tuning, and detection-as-code
- KQL and threat hunting at scale
- Microsoft Sentinel architecture, including the data lake and the Defender portal migration
- Entra ID and hybrid identity attack paths, and how to see them in logs
- Security automation with PowerShell, Python, and SOAR
Background
Seven years across IT operations and security. MS in Cybersecurity and Information Assurance (Western Governors University), BS in Computer Science (University of Illinois Chicago). Certified: CompTIA CySA+, PenTest+, Security+, ISC2 CC, and AWS Cloud Practitioner. The full story — experience, projects, and the work behind them — is on the portfolio.
Get in touch
Corrections are genuinely welcome — if something here is wrong, tell me and I'll fix it and credit you. Leave a comment on any post, connect on LinkedIn, find me on GitHub, or reach me through alisroom.com.
Frequently asked questions
Who is Ali Alshaheen?
Ali Alshaheen is a security engineer based in Chicago, IL, specializing in detection and response, Microsoft Sentinel, Defender XDR, and Entra ID identity security. He holds an MS in Cybersecurity and Information Assurance and the CompTIA CySA+, PenTest+, and Security+ certifications.
What does Ali Alshaheen do?
He runs security operations and detection engineering: turning adversary behaviour into production detection rules, hunting threats with KQL, securing hybrid cloud identity, and automating incident response with PowerShell and Python.
Where is Ali Alshaheen based?
Ali Alshaheen is based in the Chicago, IL area and is open to security engineer and security analyst roles in Chicagoland as well as remote positions.
What does this blog cover?
Working notes on detection engineering, KQL and threat hunting, Microsoft Sentinel architecture, Entra ID attack paths, and security automation — every detection is validated in a lab before it is published.
How can I contact Ali Alshaheen?
Leave a comment on any post, connect on LinkedIn or GitHub (linked below), or reach out through alisroom.com. Recruiters and hiring managers are welcome to get in touch directly.