Open to opportunities

Daryll Cuenca

@daryllcuenca

Message

Security Operations Engineer at Cato Networks building SIEM detections and AI-powered security workflows.

Philippines

Message

At Cato Networks, I own SIEM logging and data-source integrations and develop detection rules aligned with the MITRE ATT&CK framework. I also build automation and AI-enabled workflows to support security investigations and day-to-day SOC operations.

Previously, I worked as a SOC Analyst and Cyber Security Analyst across MSSP/MDR environments and internal SOC teams. My work has included incident response, threat hunting, endpoint investigations, and detection tuning, using tools such as Elastic SIEM, Microsoft Defender for Endpoint, CrowdStrike, and Microsoft Sentinel.

Experience

Work history, roles, and key accomplishments

Current

Security Operations Engineer

Current

Cato Networks

May 2026 - Present (6 months)

Promoted from SOC Analyst to Security Operations Engineer. Serve as primary escalation point for complex incidents, own SIEM integrations and detection rules, and develop automation and AI-enabled workflows.

SIEM Detection Engineering AWS Automation AI MCP ChatGpt Cursor Make.Com Incident Response Threat Hunting Documentation Playbooks

SOC Analyst

Cato Networks

Nov 2025 - May 2026 (6 months)

Played key role in SIEM field mapping and tuning, conducted endpoint threat investigations using Microsoft Defender for Endpoint, and contributed to AI-assisted investigation workflows.

SIEM Elastic SIEM (ELK Logstash Kibana)Microsoft Defender For Endpoint Incident Response Threat Hunting Automation AI Mentorship

Cyber Security Analyst

Dataprise

Apr 2025 - Oct 2025 (6 months)

Provided first-level technical resolution for cybersecurity incidents, utilized CrowdStrike, Microsoft Sentinel, and KnowBe4, and tuned detection rules and custom alert logic.

Crowdstrike Microsoft Sentinel KnowBe4 Incident Response Threat Hunting SIEM Microsoft 365 Entra ID Exchange Admin Center Microsoft Defender

SOC Analyst

ACTZERO.AI

Nov 2022 - Apr 2025 (2 years 5 months)

Acted as primary responder for security alerts, conducted analysis across network, cloud, endpoint, and mobile domains, and utilized Microsoft 365 Defender and CrowdStrike for monitoring and mitigation.

Microsoft 365 Defender Crowdstrike Threat Hunting Incident Response Confluence Allowlisting

SOC Analyst

UZADO

Feb 2021 - Nov 2022 (1 year 9 months)

Demonstrated proficiency in SOC tools including SentinelOne, Logz.io, AlienVault, Securonix, Qualys, TheHive, and Dark Web Finder. Performed system monitoring and refined detection logic.