IDENTITY MODULE // 00

MACIEJ DROBNIUCH

Cybersecurity Architect // SOAR Consultant

NetCore (ex-Palo Alto Networks XSOAR SME)

  • XSOAR / XSIAM
  • FortiGate & PAN-OS SOC Automation
  • API-Driven SOC Engineering
  • AI-Augmented Security
[ Open AI Uplink ] View Missions
TELEMETRY RD-0116
EXPERIENCE 0+ YRS
XSOAR NODES 0+ MANAGED
THROUGHPUT 0+ INC/DAY
MARKETPLACE 0 INTEGRATIONS
SYSTEM LOAD
LINK ESTABLISHED SZCZECIN / PL
SCROLL
01

PROFILE

// OPERATOR SUMMARY
PROFILE.SUMMARY TXT-01

Since January 2026 I run my own consulting company, NetCore, as an independent Cybersecurity Architect & SOAR Consultant - following a tenure as XSOAR SME at Palo Alto Networks (through December 2025). I deliver Cortex XSOAR / XSIAM architecture and migrations, FortiGate and PAN-OS SOC automation, and full-lifecycle API automation across the security stack.

With over 11 years of experience in cybersecurity and SOAR automation, I have contributed to large-scale XSOAR deployments, advanced playbook optimization, and the creation of marketplace integrations. My expertise spans threat intelligence management, CI/CD pipelines for content development, and AI-augmented security engineering (MCP servers, agentic AI workflows, LLM-assisted triage).

0
Years in Cybersecurity
0
Marketplace Integrations
0
XSOAR Servers Managed
0
Incidents/Day Automated
02

MISSIONS

// ENGAGEMENT LOG 2014-2026
JAN 2026 - PRESENT

Independent Cybersecurity Architect & SOAR Consultant

NetCore
  • Cortex XSOAR / XSIAM architecture, content development and migration engagements - the same SME work performed at Palo Alto Networks, now delivered directly to enterprise customers
  • Fortinet / FortiGate and Palo Alto PAN-OS SOC automation in XSOAR - FortiGate, FortiAnalyzer, FortiSIEM and PAN-OS / Panorama playbooks for alert enrichment, automated containment (address-group / policy updates), threat-intel push, and bidirectional case sync
  • API-driven SOC automation across the security stack - REST / GraphQL / gRPC integrations with EDR, NDR, IAM, ticketing and cloud platforms; custom Python integrations and brick-by-brick automation of L1/L2 analyst workflows
  • AI-augmented SOC tooling - MCP servers exposing XSOAR/XSIAM operations to AI agents, agentic playbook generation, and LLM-assisted triage and content review
XSOAR 8 XSIAM FortiGate PAN-OS API Automation MCP AI
FEB 2025 - DEC 2025

XSOAR SME

Palo Alto Networks
  • Led strategic migrations for enterprise customers from legacy systems to Cortex XSOAR 8
  • Facilitated technical onboarding of customers onto Cortex XSIAM
  • Provided high-level SME expertise to resolve complex deployment blockers
  • Mentored partner engineers and customer SOC teams on XSOAR/XSIAM best practices, playbook design, and content lifecycle
XSOAR 8 XSIAM Migration Enterprise
FEB 2024 - JAN 2025

XSOAR Content Development

Kyndryl
  • Architected XSOAR 8 On-prem solutions integrated with ElasticSearch clusters
  • Engineered CI/CD pipelines for standardized content development
  • Designed Threat Intel Management (TIM) strategies for indicator lifecycle automation
  • Led XSOAR capability "ramping" into business units
CI/CD ElasticSearch TIM DevSecOps
SEP 2021 - FEB 2024

XSOAR CyberSOC Automation Expert

Orange Cyberdefense
  • Managed 16+ XSOAR servers across multiple CyberSOC / Cyber Defense Centers, processing 1,000+ incidents/day with auto-remediation
  • Built FortiGate and PAN-OS SOC automation playbooks for alert enrichment, automated containment and threat-intel push
  • Published 4 official integrations to XSOAR Marketplace: EdgeScan, PAN-OS Policy Optimizer, OpenCV, UnifiNVR
  • Developed custom Prometheus XSOAR integration for system diagnostics
  • Spearheaded Global CyberSOC (Cyber Defense Center) conversion to an XSOAR-centric operational paradigm
Marketplace Prometheus Scale Cyber Defense Center FortiGate PAN-OS
MAY 2019 - AUG 2021

Senior PS Consultant / PS Consultant

Palo Alto Networks
  • Delivered end-to-end SOC automation strategies using Cortex XSOAR
  • Automated firewall migrations and pioneered IaC for cloud firewall deployments
  • Implemented container security measures for compliance and threat protection
SOC IaC Cloud Security Containers
JUL 2016 - FEB 2019

Senior Network Security Engineer

Collective Sense
  • Spearheaded anomaly detection for security incidents using ML models
  • Trained ML models on malicious traffic data for improved detection
  • Reverse engineering of application and network layer attacks
  • Utilized Metasploit and offensive tools for R&D
ML Anomaly Detection Reverse Engineering
OCT 2014 - JUL 2016

Security Solutions Architect

Akamai Technologies
  • Implemented emergency integrations during active DDoS attacks with SOC team
  • Managed BGP/GRE configuration and troubleshooting
  • Integrated anti-DDoS products into customer network infrastructures
DDoS BGP Anti-DDoS CDN
2010 - 2014

Earlier Career

IT Infrastructure Consultant at Capgemini | Technical Specialist at brightONE | Test Engineer at Tieto | Network Technician at Stream Global Services

03

SYSTEMS

// CAPABILITY MATRIX
SOAR

SOAR & SIEM

Cortex XSOAR
98
Cortex XSIAM
90
Playbook Engineering
95
Incident Automation
95
DEV

Development

Python
90
CI/CD Pipelines
85
API Integrations
92
Docker / Containers
80
SEC

Security

Threat Intelligence
88
Network Security
90
Fortinet / FortiGate
85
DDoS Mitigation
85
Incident Response
92
OPS

Infrastructure

ElasticSearch
82
Prometheus
78
Linux / Unix
88
AWS / Cloud
75
04

MODULES

// MARKETPLACE INTEGRATIONS & NOTABLE WORK
M-01

PAN-OS Policy Optimizer

Official XSOAR Marketplace integration for optimizing PAN-OS firewall security policies. Automates policy analysis and rule optimization.

MarketplacePAN-OSFirewall
M-02

EdgeScan

XSOAR integration for EdgeScan vulnerability management platform. Automated vulnerability ingestion and remediation workflows.

MarketplaceVulnerabilityScanning
M-03

OpenCV Integration

Creative XSOAR integration bridging computer vision with security operations for image analysis in automated workflows.

MarketplaceComputer VisionOpenCV
M-04

UnifiNVR

XSOAR integration for Ubiquiti UniFi Network Video Recorder. Security camera management and alerting within SOAR workflows.

MarketplaceNVRPhysical Security
M-05

Prometheus XSOAR Integration

Custom integration exposing XSOAR system diagnostics and health metrics to Prometheus for observability and reduced downtime.

CustomMonitoringObservability
M-06

Global CSOC Transformation

Led conversion of Orange Cyberdefense's Global CSOC into an XSOAR-centric paradigm. 400 concurrent incidents, zero performance degradation.

ArchitectureScaleSOC
05

AI UPLINK

// MACIEJ_BOT v1.0

Talk to my AI assistant -- it knows my experience, projects, and skills. Ask anything a recruiter would want to know, or try the XSOAR Playbook Generator.

MACIEJ_BOT v1.0 -- ONLINE
[ ENCRYPTED CHANNEL ]
M

Hello! I'm Maciej's AI assistant. I know about his experience, projects, skills, and career history.

Feel free to ask me anything -- whether you're a recruiter, a fellow engineer, or just curious about his work in XSOAR and cybersecurity automation.

XSOAR Playbook Generator -- You can also ask me to generate XSOAR playbook YAML skeletons to import and fine-tune in XSOAR. You have 2 free generations per day, so make them count! This web generator runs a lightweight AI model without access to your XSOAR instance or full content pack context -- the output is a solid starting point, not a finished product. Maciej's full skill runs on Claude Opus with Claude Code for production-grade results.

For best results, include in your prompt:

  • USE_CASE: What does the playbook do?
  • TRIGGER: How is it initiated? (Splunk alert, email, manual, etc.)
  • INTEGRATIONS: Which products? (PAN-OS, CrowdStrike, ServiceNow, etc.)
  • WORKFLOW: Step-by-step actions
  • CONDITIONS: Decision points and branches
  • EDGE_CASES: Failure scenarios and handling

Tip: Use ChatGPT or Gemini to brainstorm and refine your playbook prompt before pasting it here.

Try: "What marketplace integrations has Maciej published?" or "Generate a playbook for phishing investigation"

>

POWERED BY AI. CONVERSATIONS MAY BE LOGGED FOR IMPROVEMENT.

06

COMMS

// ESTABLISH CONNECTION
CONNECTION.ESTABLISH() CH-06
EMAIL [email protected]
LINKEDIN /in/maciejdrobniuch
WEB drobniuch.pl
LOCATION Szczecin, Poland
LANGUAGES English (Professional) | German (Professional) | Polish (Native)
// INITIATE

Interested in working together or have a project in mind?

Send Message Download CV