Open to opportunities

kelvin Odarikpe

@kelvinodarikpe

SOC analyst specializing in SIEM/EDR monitoring and incident response, improving detections and reducing false positives.

Germany

Message

What I'm looking for

I want to lead 24/7 SOC operations, tune SIEM/EDR detections with MITRE ATT&CK coverage, and run end-to-end incident response in a SOP-driven, audit-ready environment where I can automate evidence and continuously reduce MTTR and false positives.

I’m a SOC Analyst with 8+ years in security operations, alert triage, and incident response across regulated environments, including GDPR healthcare SaaS and SOC 2 / HIPAA-aligned controls. I monitor SIEM/EDR tooling daily and perform initial analysis on network intrusions, application attacks, and endpoint/system compromises—then escalate only confirmed incidents with complete, structured documentation.

In my recent role, I monitored and triaged 120+ alerts weekly, refined detection logic, and reduced SIEM false positives by 40% through rule tuning, watchlist curation, and context enrichment. I’ve built and tuned correlation rules and monitors (25+), expanded MITRE ATT&CK coverage (from 6 to 14 tactics), and led end-to-end incident response using the NIST IR lifecycle with evidence-based post-incident reviews.

I thrive in ticket-driven, ITIL-aligned operating models where SOPs matter and on-call discipline counts. I’m also hands-on with cloud and identity security signals, vulnerability management, and automation (Python/PowerShell, Graph API, evidence automation) so teams can detect faster, respond consistently, and continuously improve metrics like escalation time and MTTR.

Experience

Work history, roles, and key accomplishments

Senior SOC Analyst

IT4IPM GmbH & Gema GmbH

Feb 2024 - Jan 2026 (1 year 11 months)

Triaged and monitored 120+ weekly security alerts across Datadog, ELK Cloud SIEM, Microsoft Defender for Endpoint, and SentinelOne, escalating confirmed incidents with MITRE ATT&CK mapping and containment details. Built and tuned 25+ correlation rules/monitors, reducing SIEM false positives by 40% and improving MITRE ATT&CK coverage from 6 to 14 tactics.

Datadog Microsoft Defender SentinelOne Incident Response Correlation Rules Python

SOC Analyst, IT & Security

Dizzbo GmbH

Nov 2021 - Dec 2023 (2 years 1 month)

Stood up Azure Sentinel with Microsoft Defender for Endpoint and Purview DLP, running on-call and owning first response for security alerts in a 142-person remote-first SaaS. Contained credential-compromise attempts within 24 hours and improved security escalation accuracy from 35% to 91% while cutting escalation time by 65% using runbooks and Tier 1→2→3 processes.

Azure Sentinel Microsoft Defender Purview DLP Microsoft 365 Unified Audit Log Conditional Access Jira EDR Policy Tuning

Security Engineer, SIEM & Vuln

Humanoo GmbH

Jul 2021 - Nov 2023 (2 years 4 months)

Built the central SIEM pipeline (ELK + Kibana) to reach 100% log coverage, closing 12 monitoring blind spots via Filebeat, Metricbeat, syslog, and Azure Monitor telemetry. Hardened Linux/Windows Server to CIS Level 1 and reduced open critical CVEs by 78% within 60 days, while improving Kubernetes workload security and producing weekly posture reports.

ELK Kibana Filebeat Metricbeat azure monitor Trivy Vulnerability Management Threat Hunting

SOC Triage Engineer

Adecco Group Tech Center GmbH

Nov 2020 - Jul 2021 (8 months)

Served as a first-line triage analyst for endpoint and identity alerts, performing process/file/network investigation and escalating confirmed incidents with evidence and severity classification. Standardized runbook-driven diagnostics, cutting MTTR on endpoint incidents by 45%, and improved Intune endpoint compliance to 97% within 45 days.

Endpoint Alert Triage Intune Conditional Access Bitlocker Python PowerShell File Hash Analysis Outbound Network Review

Identity & IT Engineer

Doctolib GmbH

Sep 2018 - Oct 2020 (2 years 1 month)

Supported GDPR healthcare security by administering Active Directory/Entra ID and building access-log monitoring and privilege-usage reporting for downstream detection use cases. Architected enterprise SSO (SAML 2.0) and automated RBAC provisioning across 15+ apps, eliminating 100% orphaned accounts within 30 days and revoking 230+ excessive privilege assignments.

GDPR Healthcare Security Active Directory Entra ID SAML Conditional Access Audit Trail Workflows