maciej@drobniuch ~ identity

$ whoami

Maciej Drobniuch

$ cat role.txt

Cybersecurity Architect & SOAR Consultant // NetCore (ex-Palo Alto Networks)

$ echo $SPECIALIZATION

XSOAR / XSIAM • FortiGate SOC Automation • API-Driven SOC Engineering

$ uptime --experience

0+ years in cybersecurity | 0+ XSOAR servers managed | 0+ incidents/day automated

▶ Talk to my AI assistant View Experience

scroll

01 ./about

// profile.summary

Since January 2026 I run my own consulting company, NetCore, as an independent Cybersecurity Architect & SOAR Consultant - following a tenure as XSOAR SME at Palo Alto Networks (through December 2025). I deliver Cortex XSOAR / XSIAM architecture and migrations, FortiGate-driven SOC automation, and full-lifecycle API automation across the security stack.

With over 11 years of experience in cybersecurity and SOAR automation, I have contributed to large-scale XSOAR deployments, advanced playbook optimization, and the creation of marketplace integrations. My expertise spans threat intelligence management, CI/CD pipelines for content development, and AI-augmented security engineering (MCP servers, agentic AI workflows, LLM-assisted triage).

Years in Cybersecurity

Marketplace Integrations

XSOAR Servers Managed

Incidents/Day Automated

02 ./experience

Independent Cybersecurity Architect & SOAR Consultant

NetCore Jan 2026 - Present

Cortex XSOAR / XSIAM architecture, content development and migration engagements - the same SME work performed at Palo Alto Networks, now delivered directly to enterprise customers
Fortinet / FortiGate SOC automation in XSOAR - FortiGate, FortiAnalyzer and FortiSIEM playbooks for alert enrichment, automated containment (address-group / policy updates), threat-intel push, and bidirectional case sync
API-driven SOC automation across the security stack - REST / GraphQL / gRPC integrations with EDR, NDR, IAM, ticketing and cloud platforms; custom Python integrations and brick-by-brick automation of L1/L2 analyst workflows
AI-augmented SOC tooling - MCP servers exposing XSOAR/XSIAM operations to AI agents, agentic playbook generation, and LLM-assisted triage and content review

XSOAR 8 XSIAM FortiGate API Automation MCP AI

XSOAR SME

Palo Alto Networks Feb 2025 - Dec 2025

Led strategic migrations for enterprise customers from legacy systems to Cortex XSOAR 8
Facilitated technical onboarding of customers onto Cortex XSIAM
Provided high-level SME expertise to resolve complex deployment blockers
Mentored partner engineers and customer SOC teams on XSOAR/XSIAM best practices, playbook design, and content lifecycle

XSOAR 8 XSIAM Migration Enterprise

XSOAR Content Development

Kyndryl Feb 2024 - Jan 2025

Architected XSOAR 8 On-prem solutions integrated with ElasticSearch clusters
Engineered CI/CD pipelines for standardized content development
Designed Threat Intel Management (TIM) strategies for indicator lifecycle automation
Led XSOAR capability "ramping" into business units

CI/CD ElasticSearch TIM DevSecOps

XSOAR CyberSOC Automation Expert

Orange Cyberdefense Sep 2021 - Feb 2024

Managed 16+ XSOAR servers, processing 1,000+ incidents/day with auto-remediation
Published 4 official integrations to XSOAR Marketplace: EdgeScan, PAN-OS Policy Optimizer, OpenCV, UnifiNVR
Developed custom Prometheus XSOAR integration for system diagnostics
Spearheaded Global CSOC conversion to XSOAR-centric operational paradigm

Marketplace Prometheus Scale CSOC

Senior PS Consultant / PS Consultant

Palo Alto Networks May 2019 - Aug 2021

Delivered end-to-end SOC automation strategies using Cortex XSOAR
Automated firewall migrations and pioneered IaC for cloud firewall deployments
Implemented container security measures for compliance and threat protection

SOC IaC Cloud Security Containers

Senior Network Security Engineer

Collective Sense Jul 2016 - Feb 2019

Spearheaded anomaly detection for security incidents using ML models
Trained ML models on malicious traffic data for improved detection
Reverse engineering of application and network layer attacks
Utilized Metasploit and offensive tools for R&D

ML Anomaly Detection Reverse Engineering

Security Solutions Architect

Akamai Technologies Oct 2014 - Jul 2016

Implemented emergency integrations during active DDoS attacks with SOC team
Managed BGP/GRE configuration and troubleshooting
Integrated anti-DDoS products into customer network infrastructures

DDoS BGP Anti-DDoS CDN

Earlier Career

2010 - 2014

IT Infrastructure Consultant at Capgemini | Technical Specialist at brightONE | Test Engineer at Tieto | Network Technician at Stream Global Services

03 ./skills

[SOAR]

SOAR & SIEM

Cortex XSOAR

Cortex XSIAM

Playbook Engineering

Incident Automation

[DEV]

Development

Python

CI/CD Pipelines

API Integrations

Docker / Containers

[SEC]

Security

Threat Intelligence

Network Security

Fortinet / FortiGate

DDoS Mitigation

Incident Response

[OPS]

Infrastructure

ElasticSearch

Prometheus

Linux / Unix

AWS / Cloud

04 ./projects

Official XSOAR Marketplace Integrations & Notable Projects

PAN-OS Policy Optimizer

Official XSOAR Marketplace integration for optimizing PAN-OS firewall security policies. Automates policy analysis and rule optimization.

MarketplacePAN-OSFirewall

EdgeScan

XSOAR integration for EdgeScan vulnerability management platform. Automated vulnerability ingestion and remediation workflows.

MarketplaceVulnerabilityScanning

OpenCV Integration

Creative XSOAR integration bridging computer vision with security operations for image analysis in automated workflows.

MarketplaceComputer VisionOpenCV

UnifiNVR

XSOAR integration for Ubiquiti UniFi Network Video Recorder. Security camera management and alerting within SOAR workflows.

MarketplaceNVRPhysical Security

Prometheus XSOAR Integration

Custom integration exposing XSOAR system diagnostics and health metrics to Prometheus for observability and reduced downtime.

CustomMonitoringObservability

Global CSOC Transformation

Led conversion of Orange Cyberdefense's Global CSOC into an XSOAR-centric paradigm. 400 concurrent incidents, zero performance degradation.

ArchitectureScaleSOC

05 ./ask_me

Talk to my AI assistant -- it knows my experience, projects, and skills.
Ask anything a recruiter would want to know, or try the XSOAR Playbook Generator.

maciej_bot v1.0 -- online

[encrypted]

Hello! I'm Maciej's AI assistant. I know about his experience, projects, skills, and career history.

Feel free to ask me anything -- whether you're a recruiter, a fellow engineer, or just curious about his work in XSOAR and cybersecurity automation.

XSOAR Playbook Generator -- You can also ask me to generate XSOAR playbook YAML skeletons to import and fine-tune in XSOAR. You have 2 free generations per day, so make them count! This web generator runs a lightweight AI model without access to your XSOAR instance or full content pack context -- the output is a solid starting point, not a finished product. Maciej's full skill runs on Claude Opus with Claude Code for production-grade results.

For best results, include in your prompt:

USE_CASE: What does the playbook do?
TRIGGER: How is it initiated? (Splunk alert, email, manual, etc.)
INTEGRATIONS: Which products? (PAN-OS, CrowdStrike, ServiceNow, etc.)
WORKFLOW: Step-by-step actions
CONDITIONS: Decision points and branches
EDGE_CASES: Failure scenarios and handling

Tip: Use ChatGPT or Gemini to brainstorm and refine your playbook prompt before pasting it here.

Try: "What marketplace integrations has Maciej published?" or "Generate a playbook for phishing investigation"