Sep 2024 – Present · 1 yr 8 mos

• Lead complex security investigations involving advanced threat actors and high-severity incidents.
• Design and implement incident response automation, including auto-investigation and mitigation of identity-based alerts.
• Built automated workflows for production hosts and containerized workloads, improving detection depth and response speed.
• Drove security outcomes by reducing manual analyst effort, saving 15+ analyst-years annually through automation.
• Mentor and train junior engineers, onboarding them as effective investigators and automation engineers.

Feb 2023 – Sep 2024 · 1 yr 7 mos

• Served as Incident Commander for one year, coordinating response for security incidents across teams.
• Led SOC investigations and incident handling for enterprise-scale environments.
• Designed and executed multiple IR automations to improve response consistency and reduce MTTR.
• Played a key role in strengthening detection coverage across production infrastructure.

Nov 2021 – Aug 2023 · 1 yr 9 mos

• Led SOC operations and investigations as shift lead.
• Managed incident triage, escalation, and response coordination.
• Guided analysts through investigations and improved operational maturity of SOC processes.