Johan B.
Cape Town, South Africa · Principal Information Security Analyst | Microsoft Sentinel & KQL Detection Engineering | Threat Hunting | CTI | Blue Team | 20+ Years | ex-Military Intel · NTT DATA
ISC2
About
Principal Information Security Analyst with 20+ years across defence, consulting, and enterprise SOC environments. Currently leading detection engineering and threat intelligence operations for high-risk sectors including Fintech, HR SaaS, and Media — environments where the cost of a miss is measured in regulatory exposure and data breach impact. My work sits at the intersection of threat intelligence and automated defence. I build and tune production KQL Analytics Rules in Microsoft Sentinel, map coverage gaps to MITRE ATT&CK, and develop threat hunting hypotheses from CTI that translate directly into detections. My background in military intelligence shapes how I approach adversary profiling: understanding actor intent, not just IOCs. Core Capabilities: Detection Engineering · KQL (Advanced) · Microsoft Sentinel · MITRE ATT&CK · CrowdStrike Falcon · Microsoft Defender XDR · SOAR Automation · Threat Hunting · Cyber Threat Intelligence · OSINT · Incident Response · Vulnerability Management · ISO 27001 · PCI-DSSMicrosoft Sentinel KQL (Kusto Query Language) Threat Hunting Cyber Threat Intelligence (CTI) MITRE ATT&CK Detection Engineering Incident Response CrowdStrike Falcon OSINT Microsoft Defender XDR
Experience
-
NTT DATA
-
Principal Information Security Analyst
May 2026 — Present
City of Cape Town
-
Senior Information Security Analyst / SOC Engineer
Dec 2025 — May 2026
Western Cape, South Africa
-
-
Personal goal pursuit
Career Break
Sep 2025 — Dec 2025
8 experiences in total
Education
-
ISC2
SSCP, Cyber Security, IT Administration & Cyber Security
Jan 2000
-
Comptia / ICS2
CSAP - CySa+ - Security+ - SSCP, IT Administration & Cyber Security
Jan 2000
3 education entries in total