SHABAN RAZAcybersecurity expert
Mehar Muhammad Shaban Raza, cybersecurity expert and ethical hacker in Lahore, Pakistan

Mehar Muhammad Shaban Raza, Cybersecurity Expert in PakistanI'm a Cybersecurity Expert

Ethical hacker, SOC & SIEM specialist with 7+ years of experience. I find the weak points in networks, cloud platforms and applications, build security operations that catch threats as they happen, and shut incidents down fast.

My work Hire me
live console

$ soc --live

Security operations console

A simulated view of what I do every day: scanning the network, catching threats in seconds and shutting them down.

THREAT RADAR

$ whoami

About me

I'm a cybersecurity expert in Pakistan with 7+ years on both sides of the fight. On offense, I run penetration tests the way real attackers would. On defense, I build the monitoring, response playbooks and policies that keep organisations standing when attacks come.

Today I lead cybersecurity at Medcare MSO, protecting a regulated, cloud-hosted environment across Microsoft Azure and Microsoft 365. I also run Ceaser Tech, my security and IT services company, and I have trained 5,000+ students and professionals in ethical hacking and practical security.

I speak both languages of security: packet captures and exploit chains with engineers, risk and return with executives.

OPERATOR PROFILE
role
Cybersecurity Expert
specialty
SOC, SIEM & pentesting
location
Lahore, Pakistan
experience
7+ years
trained
5,000+ professionals
mode
Offensive + defensive
status
available for projects

$ ls ./capabilities

Capabilities

  • Penetration testing

    Network, web and cloud assessments that find what scanners miss.

    MOD-01

  • Threat detection

    SIEM deployment and tuning so real attacks stand out from the noise.

    MOD-02

  • Incident response

    Playbooks, device isolation and fast containment under pressure.

    MOD-03

  • Cloud security

    Hardening Microsoft Azure and Microsoft 365 tenants end to end.

    MOD-04

  • Identity & access

    Least privilege, MFA and conditional access that people follow.

    MOD-05

  • Governance & compliance

    ISO 27001, HIPAA, security policies and audits that hold up.

    MOD-06

  • AI & LLM security

    Guardrails against prompt injection and the OWASP LLM Top 10.

    MOD-07

  • Security training

    Hands-on ethical hacking courses for teams and students.

    MOD-08

$ soc --status --verbose

SOC & SIEM operations

A Security Operations Center is only as good as what it can see and how fast it acts. I build SOCs that turn millions of raw log events into a handful of alerts that matter, and I deploy and tune SIEM platforms so analysts spend their time on real attacks instead of noise.

From log onboarding to detection engineering and response playbooks, I cover the full detection lifecycle, mapped to the MITRE ATT&CK framework.

  1. 01

    Collect

    Onboard logs from endpoints, firewalls, servers, cloud and identity providers.

  2. 02

    Normalise

    Parse, enrich with threat intelligence and add asset and user context.

  3. 03

    Detect

    Correlation rules and use cases mapped to MITRE ATT&CK techniques.

  4. 04

    Triage & hunt

    Investigate alerts, tune out false positives and hunt for hidden threats.

  5. 05

    Respond

    Playbooks and automated containment that stop attacks in minutes.

DETECTION USE CASES

Threats my detections catch

  • Brute force & password spraying
  • Impossible travel logins
  • Privilege escalation
  • Malware & C2 beaconing
  • Phishing & business email compromise
  • Ransomware precursors
  • Data exfiltration
  • Lateral movement
  • Insider threats
  • Suspicious cloud admin activity
WHAT YOU GET

SOC & SIEM services

  • SOC design and build, from zero to 24/7 monitoring
  • SIEM deployment, log source onboarding and health monitoring
  • Detection engineering and custom correlation rules
  • Alert tuning to cut false positives and analyst fatigue
  • Incident triage and response playbooks, SOAR automation
  • SOC analyst training for your team

$ cat ./experience.log

Experience

  1. ACTIVE

    Cybersecurity Manager

    Medcare MSO, United States

    • Lead incident response, SIEM operations and cloud security for a regulated, Azure-hosted environment.
    • Authored the organisation's Incident Response & Device Isolation Policy and its IT Security & Data Protection Policy.
    • Deployed SIEM monitoring and run SOC operations: log onboarding, detection rules, alert triage and threat hunting.
    • Manage identity and access across Microsoft 365 and Azure.
    • Drive cloud cost optimisation without weakening security controls.
    • Own security vendor evaluation, software licensing and compliance reporting to leadership.
  2. ACTIVE

    Founder

    Ceaser Tech

    • Deliver cybersecurity consulting and IT services to businesses.
    • Provide a cyber threat intelligence platform and an ERP solution to clients.
  3. ONGOING

    Cybersecurity Instructor

    Universities, training programmes and community events

    • Teach ethical hacking and practical security to students and working professionals.
    • Support university security events, workshops and capture-the-flag competitions across Pakistan.

$ verify --credentials

Certifications

  • CPENTCertified Penetration Testing ProfessionalEC-CouncilVERIFIED
  • CEHCertified Ethical HackerEC-CouncilVERIFIED
  • ISO 27001Lead Auditor, Information Security ManagementISO/IECVERIFIED
  • CLLMSECertified LLM Security ExpertRed Team LeadersVERIFIED
  • SC-401Microsoft Certified: Information Security Administrator AssociateMicrosoftVERIFIED
  • SC-900Microsoft Certified: Security, Compliance & Identity FundamentalsMicrosoftVERIFIED
  • +20More certifications and specialised courses in offensive security, networking and cloud.View all on LinkedInOPEN

$ ls ./case-files

Cybersecurity projects

  • [ offensive ]

    Network & web application penetration testing

    End-to-end attacks on external perimeters, internal networks, Active Directory and web applications, followed by reports with clear, prioritised fixes.

    • OWASP Top 10
    • Active Directory
    • Burp Suite
    • Nmap
    • Metasploit
  • [ detection ]

    Enterprise SIEM deployment & SOC build

    Deployed SIEM monitoring for a regulated, cloud-hosted environment: log source onboarding, correlation rules, alert tuning and analyst triage runbooks.

    • MITRE ATT&CK
    • Log onboarding
    • Threat hunting
    • Alert tuning
  • [ compliance ]

    ISO/IEC 27001 implementation & audit

    ISMS implementation from gap assessment to certification readiness: risk assessment, Statement of Applicability, Annex A controls and internal audits.

    • ISO 27001:2022
    • Risk register
    • SoA
    • Internal audit
  • [ response ]

    Incident response & device isolation programme

    Built the incident response and device isolation policy: severity levels, escalation paths, containment steps and a management-ready playbook.

    • IR playbooks
    • Containment
    • Escalation matrix
  • [ cloud ]

    Microsoft 365 & Azure security hardening

    Locked down cloud tenants with conditional access, MFA, least-privilege roles, and data loss prevention and sensitivity labels in Microsoft Purview.

    • Entra ID
    • Conditional access
    • Purview DLP
    • Defender
  • [ governance ]

    IT security & data protection policy framework

    Wrote a company-wide security and data protection policy set, aligned with HIPAA requirements and adopted at executive level.

    • HIPAA
    • Data classification
    • Acceptable use
    • Access control
  • [ threat intel ]

    Cyber threat intelligence platform rollout

    Deliver a cyber threat intelligence platform to Ceaser Tech clients so they see emerging threats, leaked credentials and attacker infrastructure early.

    • Threat intelligence
    • IOC feeds
    • Dark web monitoring
  • [ ai security ]

    LLM application security testing

    Testing AI and LLM applications for prompt injection, data leakage and jailbreaks, and engineering guardrails against the OWASP Top 10 for LLMs.

    • OWASP LLM Top 10
    • Prompt injection
    • Guardrails
  • [ cloud ]

    Secure Azure cost optimisation

    Cut cloud spend by right-sizing and removing idle resources, while keeping every security control, log source and backup intact.

    • Azure
    • FinOps
    • Resource governance

$ ./mission --print

Teaching & community

The strongest firewall is a well-trained person.

I have trained 5,000+ professionals in ethical hacking and practical security, spoken on panels such as Cyberfest's National Cybersecurity Future, and written for national newspapers on Pakistan's IT industry. Universities, bootcamps and companies can book a session through the contact channel below. See the gallery.

$ ls ./knowledge

Cybersecurity knowledge base

Browse all 20 articles

20 in-depth, referenced guides from real security work: SOC and SIEM, MITRE ATT&CK, penetration testing, zero trust, ISO 27001 and NIST CSF, incident response, cloud security and building a cybersecurity career in Pakistan. Featured below.

$ man shabanraza

Frequently asked questions

Who is Mehar Muhammad Shaban Raza?

Mehar Muhammad Shaban Raza is a cybersecurity expert based in Lahore, Pakistan, with 7+ years of experience. He is a Cybersecurity Manager, certified ethical hacker (CPENT, CEH), ISO 27001 Lead Auditor, Microsoft certified in security (SC-401, SC-900) and founder of Ceaser Tech.

What cybersecurity services do you offer in Pakistan?

I offer SOC design and SIEM deployment, penetration testing, incident response, cloud security for Microsoft Azure and Microsoft 365, ISO 27001 and compliance consulting, and hands-on cybersecurity training.

Can you build a SOC or deploy a SIEM for my company?

Yes. I design security operations from the ground up: onboarding log sources, writing detection rules mapped to MITRE ATT&CK, tuning alerts to cut false positives, and writing the triage and response playbooks your analysts follow.

Do you provide penetration testing services?

Yes. I run network, web application and cloud penetration tests the way real attackers would, then deliver a clear report with prioritised fixes. I hold the EC-Council CPENT and CEH certifications.

Do you work with international clients?

Yes. I already secure a US-based organisation's cloud environment and work remotely with clients worldwide, as well as on-site across Pakistan.

Do you offer cybersecurity or ethical hacking training in Lahore?

Yes. I have trained 5,000+ professionals and teach ethical hacking and SOC skills to students, universities and corporate teams in Lahore and across Pakistan, online or in person.

$ ssh contact@meharmuhammadshabanraza.com

SECURE CHANNEL

Let's make your systems harder to break.

Penetration testing, security consulting, training or a speaking invitation. I reply within two working days.