Ankit Mehta

I’m a Detection Engineer specializing in Microsoft Sentinel, KQL, and Detection-as-Code, focused on turning threat intelligence into reliable, deployable detections. I build detections aligned to MITRE ATT&CK and ship them in a scalable way using GitHub CI/CD for consistent rollouts.

I’ve built 120+ detections and reduced false positives by ~40–45% through detection tuning. I also create custom Sentinel workbooks and automate threat intel ingestion using Logic Apps to improve both coverage and operational efficiency.

On the investigation side, I’ve worked across M365, Entra ID, Intune, and Microsoft Defender, performing SOC investigations and DFIR. I lead threat hunting and malware analysis on real-world campaigns, mapping outcomes back to MITRE ATT&CK to strengthen detection coverage and visibility.

I bring a hands-on security mindset across detection engineering, incident response, and log analytics, using tools like SentinelOne and Velociraptor for endpoint and network telemetry. I aim to partner with security teams to improve detection maturity, response speed, and analytical clarity with measurable results.