Headline

SIEM ENGINEERING • DETECTION ENGINEERING Microsoft Sentinel | Elastic SIEM | KQL

About

I engineer the security telemetry pipelines and detection logic that enterprise SOCs run on — not just monitor the alerts they produce. Over the past 2 years at a fast-moving cybersecurity startup, I've owned SIEM engineering end-to-end across 20+ enterprise customer environments spanning telecom, real estate, and F&B/manufacturing. Startup environments don't give you narrow lanes — I've been the engineer onboarding the log source, building the parser, writing the correlation rule, tuning the false positive, AND explaining the fix to the customer, often on the same day. What I do: → Architect and maintain SIEM platforms across Microsoft Sentinel and Elastic Stack (Elasticsearch, Logstash, Kibana, Elastic Agent) → Own log source onboarding end-to-end: integration, parsing, normalization, schema mapping, and validation — 21+ log sources onboarded across cloud, endpoint, identity, and firewall platforms → Build and tune detection logic — KQL analytics rules, Elastic EQL detections, correlation rules — mapped to MITRE ATT&CK → Build and maintain Elastic clusters, troubleshoot ingestion pipelines, and resolve parser/field-mapping issues at the data layer → Run customer-facing onboarding, requirements gathering, and technical support across enterprise clients including Tata Teleservices, Seef Properties, and Coca-Cola Bottling KSA → Automate SOC workflows using Logic Apps, Python, and PowerShell to cut manual triage time Core stack: Microsoft Sentinel, Elastic SIEM (Elasticsearch/Logstash/Kibana), KQL, Elastic EQL, CrowdStrike, Palo Alto, FortiGate, Azure, AWS, Entra ID Certified: CEH v12 (EC-Council), AWS Certified Solutions Architect – Professional I'm currently exploring SIEM Engineer, Detection Engineer, and Security Engineering roles — especially teams building out SIEM content, log onboarding pipelines, or detection coverage at scale. Open to GCC, remote, and hybrid India-based opportunities. Let's connect.

Location

Dubai

AI stack

claude code

claude

gemini

geminicli

grok

openai

Work experience

SIEM Engineer at TechensGlobal, Oct 2024 - Present · 2 yrs 1 mo, On-site, • Engineered and maintained SIEM detection and telemetry pipelines across 20+ enterprise customer environments on Microsoft Sentinel and Elastic SIEM. • Onboarded and integrated 21+ security log sources spanning cloud, endpoint, identity, and firewall platforms, cutting manual log-source setup time through standardized onboarding workflows. • Built and tuned KQL analytics rules and Elastic EQL detections mapped to MITRE ATT&CK, reducing false-positive alert volume through iterative tuning cycles. • Designed parsing, normalization, and schema mapping logic to ensure telemetry quality across Windows, Linux, Microsoft 365, Defender XDR, Entra ID, AWS CloudTrail, Palo Alto, FortiGate, and CrowdStrike sources. • Built and maintained Elastic clusters (Elasticsearch, Logstash, Kibana, Elastic Agent), troubleshooting ingestion failures, parser errors, and pipeline bottlenecks. • Automated SOC workflows using Logic Apps, Python, and PowerShell, reducing manual effort in repetitive triage and reporting tasks. • Delivered technical onboarding and support directly to enterprise clients (Tata Teleservices, Seef Properties, Coca-Cola Bottling KSA), gathering requirements and translating them into telemetry integration plans. • Authored onboarding guides and integration documentation adopted as internal reference material for new log source integrations.

Intern at RedTeam Hacker Academy, Jul 2023 - Jun 2024 · 1 yr, On-site

Intern at Kerala State Electricity Board (KSEB), Dec 2022 - Dec 2022 · 1 mo, Kochi, Kerala, India

Education

Bachelor of Technology - BTech, Electrical and Electronics Engineering, APJ Abdul Kalam Technological University

Bachelor of Technology - BTech, Electrical and Electronics Engineering, Model engineering college