Open to opportunities

Bilal Afzal

@bilalafzal1

Message

Senior Security Engineer specializing in SIEM, threat detection, and cloud security.

United States

Message

What I'm looking for

I am seeking a senior security role where I can lead SIEM/detection engineering, drive proactive threat hunting, and contribute to compliance and cloud security improvements.

I am a Senior Security Engineer with 7+ years of experience focused on threat detection, SIEM engineering, and cloud security across healthcare and enterprise environments. I have a proven track record onboarding MSSP and EDR platforms, building custom detections, and leading SOC operations to reduce mean time to detect and lower false positives.

My work includes supporting HITRUST and SOC 2 audits, deploying CSPM solutions, integrating identity providers, and developing detection playbooks and automated response workflows. I have engineered detections and tuned SIEM/EDR platforms to measurably improve analyst efficiency and incident response.

I hold GIAC GMON, CASP+, and Security+ certifications, and I emphasize proactive threat hunting aligned with MITRE ATT&CK, continuous SOC improvement, and practical compliance support to strengthen overall security posture.

Experience

Work history, roles, and key accomplishments

Current

Senior Security Engineer

Current

Included Health

May 2021 - Present (4 years 5 months)

Led SOC operations and SIEM/EDR engineering, onboarding MSSP/EDR platforms and building custom detections that reduced false positives by 35% and improved MTTD. Supported HITRUST and SOC 2 audits and implemented CSPM across AWS/GCP.

SIEM Detection Engineering CrowdStrike Orca Security Okta Incident Response Threat Hunting Crowdstrike

Security Operations Engineer

New York-Presbyterian Hospital

Jan 2018 - Apr 2021 (3 years 3 months)

Collaborated with architects and SOC analysts to detect, triage, and remediate threats across a healthcare network; built Splunk ES detection dashboards and performed proactive threat hunting. Managed endpoint tools and supported red-vs-blue exercises and RCA reports.

Splunk Threat Hunting Sysmon Incident Response Dashboarding Vulnerability Management

Identity Management Analyst

New York-Presbyterian Hospital

Jan 2016 - Jan 2018 (2 years)

Provided global IAM support including provisioning and deprovisioning across Active Directory, Exchange, Citrix, ServiceNow, and Okta, and handled high-volume ServiceNow requests to maintain access controls and compliance.