At Zoho Corporation, I operate the SIEM detection pipeline across Falcon LogScale and ManageEngine Log360, from log onboarding and custom parsers to ATT&CK-mapped rules and alert tuning. I also hunt for APT activity across EDR and SIEM data covering AWS, Azure, and on-prem workloads.
I built and deployed Python and LLM automation for L1–L3 alert triage, enriching alerts with IOC reputation and asset and user context. I use Claude and local Ollama models to draft detection rules, then test and tune each one before it goes live.
I lead L2/L3 incidents from triage and containment through recovery and root-cause analysis, and conduct forensic investigations with Magnet AXIOM and Cellebrite. My work also includes cloud workload hardening, vulnerability management, and data-exfiltration detection.
On my personal project LogSec, I built an AI-assisted SIEM and triage platform that runs on a local Ollama model, keeping log data within the network. Earlier, at Intellect Design Arena Ltd, I worked rotating shifts in a 24/7 fintech SOC and handled incidents, vulnerability scans, phishing analysis, and malware investigations.
