Calvin Nguyen

I’m a Cybersecurity Engineer with 5+ years of experience in 24x7 security operations, threat hunting, and detection engineering across enterprise environments. I focus on MITRE ATT&CK–aligned TTP alerting and correlation logic tuning to improve signal quality when it matters most.

At SLB, I defend enterprise systems through proactive threat hunting across identity, endpoint, and network telemetry. I built and validated TTP-based detection logic in XSIAM XQL and Google SecOps YARA-L, then used Atomic Red Team and coverage dashboards to measure and raise detection effectiveness.

I strengthen detection outcomes by writing and reviewing correlation logic with cross-source joins and risk-based alerting to reduce false positives. I also lead purple team exercises, track coverage gaps using ATT&CK Navigator heatmaps, and present results through live detection demos that drive continuous improvements.

During incident response, I execute containment and escalation investigations—EDR host isolation, Azure AD token revocation, timeline reconstruction, EDR process tree analysis, KAPE Windows log analysis, and Wireshark packet review—while staying hands-on and supportive. I’ve also automated email triage with LLM-based workflows, and operationalized threat intelligence enrichment using commercial feeds and OSINT to improve triage accuracy and backlog.