Egor Kovalev

I'm currently building and running SecOps architecture, detection engineering, and incident response for a remote fintech company, while providing technical direction to a four-person team.

I redesigned its ELK deployment into a georeplicated multi-node cluster across three data centers, achieving 99.9% uptime, reducing resource consumption by approximately 80%, and extending retention to 90 days. I also built an in-house Elastic Defend and Wazuh EDR stack, authored 400+ detection rules, and reduced MTTD from roughly 24 hours to 15 minutes.

Previously at KPMG, I built a SOC from the ground up, implemented ELK-based SIEM and vulnerability management programs, investigated incidents, automated security operations, and performed penetration testing across web applications, WAFs, wireless networks, and Active Directory environments.

My work combines defensive engineering with offensive security thinking: I use attacker behavior to create practical correlation rules, playbooks, threat models, and automated response workflows with Python, IRIS, and SOAR platforms.