⟩ Blue Team Operations
DETECTION AS CODE
SIEM Engineering
Designed scalable log pipelines and high-fidelity detections.
What I deliver
- Parser & normalization design
- Use-case backlog management
- Noise reduction & alert tuning
⟩ real-world projects
Selected engagements
Sanitized highlights from real client work — approach, the bug we found, and the fix shipped. Names redacted under NDA.
01
Detection-as-code pipeline on GitOps — 180 Sigma rules tested via Atomic Red Team in CI
02
Alert tuning sprint — false positives reduced 78% over 6 weeks for telco SOC
⟩ common vulnerabilities & how I find them
Top bugs I hunt — and the steps
The recurring weaknesses I see in this domain, with the repeatable workflow I run from discovery to fix.
01
MediumParser Drift / Field Mismapping
- STEP 1Compare ingest sample vs CIM / ECS schema
- STEP 2Identify dropped or coerced fields breaking detections
- STEP 3Patch parser + add unit tests in CI
- STEP 4Backfill index-time fixes where critical
02
LowNoisy Detection Rule
- STEP 1Calculate 30-day precision per rule
- STEP 2Add allow-list (vuln scanners, jump hosts, service accounts)
- STEP 3Convert to anomaly threshold or correlation
- STEP 4Document tuning + re-test with Atomic Red Team
03
HighDetection Blind Spot in Cloud-Native Services
- STEP 1Inventory managed services (Lambda, Functions, Cloud Run) and confirm log export is actually enabled
- STEP 2Check for sampled or truncated logging on high-volume serverless invocations
- STEP 3Validate detections exist for the cloud-native equivalents of on-prem techniques (e.g. IAM instead of AD)
- STEP 4Fix: enforce logging-on-by-default via policy-as-code, alert on services with no log sink configured
⟩ arsenal
Tools & frameworks
Splunk
SIEM Platform
Sentinel
Cloud SIEM
Chronicle
Cloud SIEM
ELK
Log Analytics
Graylog
Log Management
Sigma
Detection Rules
Wazuh
Open-Source XDR
Cribl
Security Tool
Kafka
Security Tool
⟩ engage
Need siem engineering expertise?
⟩ related