I've spent the last decade in security operations - building detection content, hunting threats, and helping enterprises mature their SOCs at Securonix. I now work at the intersection of detection engineering and applied AI: writing ATT&CK-mapped detections, verifying them against simulated attacks, and building guardrailed LLM pipelines - then measuring honestly whether they actually help.

If you're working on detection engineering, AI for security operations, or SOC automation - I'd love to talk.

• LLM security & governance - PII-masking gateway design (regex → NER → local LLM), and evaluating LLM outputs against ground truth: grounding, unsupported statements, IOC completeness, ATT&CK accuracy, query validity and confidence calibration - informed by ISO/IEC 42001
• Applied ML for SOC operations - explainable models for threat triage and agentic pipelines for ticket generation

AlertMind - AI-Assisted Mini SOC 🛡️ (capstone - complete)

• End-to-end SOC architecture: Built an isolated Wazuh 4.14.5 lab ingesting Windows/Sysmon and Linux/auditd telemetry, with two operational dashboards, three incident-response playbooks, and verified 90-day retention across 21 managed alert indices.
• Detection engineering: Authored 25 Sigma detections and implemented 24 as custom Wazuh rules, with Windows service creation mapped to built-in rule 61138; documented ATT&CK-mapping caveats and verified all custom rules through controlled simulations, including Atomic Red Team.
• Detection performance: Measured a 2.32-second median attack-to-alert latency and retained command output, screenshots, rule sources, and tuning notes-including false-positive exclusions and known indicator-versus-behavioural coverage gaps.
• Guardrailed AI triage: Engineered a Python/Streamlit Tier-1 assistant supporting local, hosted, and deterministic mock providers, with tested credential redaction, strict JSON validation, prompt-injection visibility, an independent boundary gate, and auditable runs.
• Constrained by design: Assistant outputs are draft-only under mandatory analyst review, with no Wazuh write/action path, no response tools, and no enforcement integration.
• Measured human impact: On a frozen 20-alert corpus, all 14 correctly dispositioned alerts were triaged faster, while all six incorrect dispositions were slower (+1.68 min paired median); analyst review preserved 20/20 accuracy while exposing its measurable time cost.
• Evaluation integrity: A strict label-reduced view collapsed llama3.1:8b's exact ATT&CK score from 14/14 to 1/14, revealing label copying rather than independent classification; the model also identified 0/6 benign false positives, supporting a documented no-deploy decision for that use case.
• Reproducible and honestly scoped: Backed by 67 automated tests, a hashed corpus, retained audit logs, timing data, manual grounding worksheets, and a re-runnable analysis notebook; live Wazuh-to-assistant integration remains an explicitly documented target state, not a shipped feature.

Project KAVACH 🔍

A solo four-week security engagement for a fictional Indian NBFC, fusing network forensics (PCAP triage, hypothesis-driven analysis with confirm/refute verdicts, IOC extraction with confidence ratings) with web application security assessment (OWASP Top 10 exploitation, code-level remediation, before/after Semgrep SAST baselines) — synthesized into a joint STRIDE threat model and a seven-layer defence-in-depth proposal with a board-ready executive readout.

AI-SOC-Assistant - Explainable, local-first SOC triage platform.

Classifies network connections into five classes - Normal, DoS, Probe, R2L, and U2R - instead of returning only a binary anomaly flag.

• Detection and evidence: Fuses a Random Forest family classifier with a training-calibrated Isolation Forest signal. Per-connection SHAP evidence shows which observed features support or oppose the verdict.
• Live workflow: Delayed replay and Kafka-compatible events feed a shared inference runtime and a dark Streamlit console for triage, SHAP analysis, incident tickets, and analyst review.
• Governed GenAI: Generates evidence-bound tickets through deterministic templates or a guardrailed LangGraph workflow. Supports offline deterministic operation and local Ollama; cloud providers and threat-intelligence lookups are explicit opt-ins.
• Feedback loop: Stores tickets and append-only analyst reviews in SQLite. Reviewed false positives become weighted retraining examples saved as atomic, versioned model artifacts.
• Honest evaluation: Achieved 99.88% NSL-KDD holdout accuracy and 74.40% KDDTest+ accuracy; zero-tuning transfer to UNSW-NB15 reached 58.89% accuracy and 16.02% macro F1, quantifying the cross-dataset generalization gap.
• Engineering quality: Backed by 118 automated tests, Python 3.10-3.12 CI, reproducible evaluation artifacts, and non-root Docker checks.

SentinelScribe - A three-pass GenAI pipeline that transforms raw cybersecurity course audio transcripts into structured, forensically-accurate Markdown study guides.

Deep-Learning-Projects - Iterative CNN optimization achieving >90% on CIFAR-10 and ~73% on CIFAR-100 in PyTorch, using SGD with Nesterov Momentum and Cosine Annealing.

Detection & SIEM

AI / ML / GenAI

Forensics & AppSec

Data / Platforms

Securonix (2015 – 2025) — progressed from Information Security Analyst to Senior Technical Account Manager, leading threat hunting, SIEM/UEBA content development, and customer success across enterprise SOC programs. Highlights:

• Drove a 25% reduction in alert fatigue for an enterprise client by re-engineering Insider Threat policies and threat models.
• Led end-to-end development of advanced detection content mapped to MITRE ATT&CK, lowering false positives and accelerating investigations.
• Contributed to Securonix Threat Labs threat intelligence publications (APT activity, ransomware, vulnerability exploitation, IOC/TTP analysis).
• Built and mentored an offshore team standardizing SIEM parsers and out-of-the-box content.

• GIAC — AWS Secure Builder
• MITRE ATT&CK — Fundamentals · Cyber Threat Intelligence · Threat Hunting & Detection Engineering
• SANS SEC401 — Security Essentials Bootcamp

• PG Certificate, AI/GenAI Powered Cybersecurity, IIT Roorkee × Futurense — Cohort 1
• M.S. Cyber Security Engineering, University of Southern California — GPA 3.70
• B.Tech Information Technology (Honors), The NorthCap University

_{Open to Senior SOC Engineer, Senior Detection Engineer, and AI Security Engineer roles — and collaborations in AI for security operations, detection engineering, and SOC automation.}