Detection Engineering • SOC Operations • Response Automation

Security Engineer Focused on Detection, Triage, and Scalable Incident Response

Security engineer experienced in production detection engineering and 24/7 SOC environments. I build scalable detections, triage high-volume alerts, and support incident response through automation and tuning to improve signal quality and reduce MTTR.

  • Shipped production detections using SQL over 1B+ row datasets
  • Cut compute costs 95% and reduced false positives 60% through tuning
  • Built response automation adopted across 10+ detections to speed triage and MTTR
View Projects Download Resume Contact Me

Open to SOC Analyst / Security Engineer / Detection Engineering roles — let’s connect.

1B+ Rows Queried
95% Lower Compute Cost
60% Fewer False Positives
40% Faster Triage
Sunny Shah headshot

Security Engineer • Detection & Response

GitHub LinkedIn Medium
sunnydilipkumar.shah@gmail.com

Focus

High-fidelity detections + scalable response automation

Style

Performance-first tuning, validation, clear playbooks

About

I’m a security engineer focused on detection engineering, response automation, and threat modeling. Most recently, I interned on Meta’s Security Engineering team, where I built production detections using SQL over datasets exceeding 1B rows, optimized queries and thresholds to reduce compute cost, and refined signals to reduce false positives. I also designed response automation workflows that enriched alerts, gathered evidence automatically, and auto-closed low-risk alerts to improve triage speed and MTTR.

Before Meta, I worked in SOC environments handling high-volume alerts across endpoint, network, and application telemetry. I’m strongest at turning attacker behaviors into clear detection logic, validating signals in controlled test environments, and tuning for fidelity so alerts stay actionable. I also enjoy writing playbooks that standardize investigation steps and improve handoffs between SOC and IR.

I’m seeking SOC Analyst / Security Engineer / Detection Engineering roles. Friendly note: I’m always happy to walk through my projects live.

Behavior → Logic

Turn attacker behaviors into clear, testable detection logic.

Fidelity at Scale

Validate + tune for actionable alerts (less noise, lower cost).

Automation & Playbooks

Enrichment, evidence gathering, auto-close logic, and handoff-ready docs.

Experience

Production detection engineering + SOC investigation work focused on measurable impact.

Meta

Security Engineering Intern

May 2025 to August 2025

Built and tuned production detections and response automation using a TTP-based threat modeling approach in a production-scale environment supporting 4B+ users.

  • Built and deployed production-grade SQL detections operating on billion-row datasets supporting 4B+ users, using TTP-based threat modeling to align coverage with real-world attacker behaviors.
  • Reduced false positives by 60% and cut compute costs by 95% through detection tuning, query optimization, and structured validation in controlled test environments.
  • Designed scalable response automation workflows adopted across 10+ detections, decreasing alert triage time by 40% and contributing to a 25% reduction in MTTR.
  • Identified and closed a detection gap between data exfiltration and downstream misuse by engineering correlation logic that strengthened defense-in-depth controls.
  • Collaborated with Security Operations and Incident Response teams to investigate high-fidelity alerts, shadow SEV escalations, and deliver a standardized threat response playbook to operationalize detection logic.
SQL Python SIEM SOAR TTP-based threat modeling MITRE ATT&CK

Demmisto Technologies

Cyber Security Analyst

January 2024 to May 2024

Tier 1 SOC analyst work across multiple client networks, handling daily alert triage, investigations, containment, tuning, and vulnerability validation.

  • Led Tier 1 SOC triage in a 24/7 environment, analyzing 150–200 daily SIEM/EDR alerts (Splunk, Microsoft Sentinel, Wazuh) and reducing MTTR by 30% across phishing, malware, and intrusion cases.
  • Performed static and dynamic malware analysis in sandbox environments, extracting IOCs and identifying C2 activity to accelerate threat containment by 40%.
  • Strengthened detection quality by tuning SIEM correlation rules using SPL and KQL, decreasing false positives by 25% and improving alert fidelity.
  • Investigated OWASP Top 10 web application attacks and conducted internal penetration testing, driving remediation efforts that reduced high-risk vulnerabilities by 25%..
  • Mapped adversary TTPs to MITRE ATT&CK and authored executive-ready incident reports, maintaining 95%+ SLA compliance while improving cross-team incident response coordination.
Splunk Microsoft Sentinel Wazuh SPL KQL MITRE ATT&CK

Aditech Infotech

Security Engineer

August 2022 – December 2023

24/7 SOC work supporting global enterprise customers, triaging SIEM/EDR alerts and partnering with IR on high-severity investigations.

  • Secured 500+ endpoints across multi-client environments by triaging 40–60 daily alerts using Splunk, Suricata (IDS/IPS), and FortiGate, detecting phishing, malware callbacks, and unauthorized access attempts.
  • Improved SOC efficiency by reducing false positives by 35% through light detection tuning, correlation rule refinement, and IDS threshold optimization.
  • Accelerated incident investigations by performing host and network forensic analysis (Windows logs, Linux logs, PCAP), improving mean time to detect by 25%.
  • Strengthened containment efforts by executing firewall rule updates, IP/domain blocking, and access control corrections, contributing to a 20% reduction in MTTR.
  • Identified exploitable attack paths through vulnerability scanning (Nmap) and validation testing (Metasploit, Burp Suite), driving remediation that reduced external risk exposure by 40%.
Splunk Suricata FortiGate Windows Event Logs Linux logs PCAP analysis Nmap Metasploit Burp Suite

Projects

Agentic AI Threat Correlation Engine

GitHub

An agentic correlation engine that links related security signals into actionable incidents for faster response.

Impact & Implementation

Implementation

  • Designed an agent-based correlation architecture to group related alerts into unified security incidents.
  • Built Python-based data pipelines to ingest, normalize, and enrich multi-source security telemetry.
  • Implemented behavior-based analytics to identify relationships across alerts using contextual attributes (timestamps, hosts, users, IOCs).
  • Developed a threat intelligence enrichment engine to aggregate and attach contextual data directly into case records.
  • Integrated optimized SIEM/SOAR rule logic to reduce redundant alerts and improve signal precision.
  • Structured correlated outputs for operational use in investigation workflows and reporting.

Impact

  • Reduced incident response time by 40% by automatically linking related alerts into actionable cases.
  • Decreased false positives by 90%, significantly improving alert fidelity and analyst efficiency.
  • Improved detection accuracy through behavior-based correlation and contextual enrichment.
  • Accelerated enterprise triage by reducing manual alert stitching and investigation overhead.
  • Strengthened decision-making by delivering enriched, investigation-ready case data.

Threat-Scoped Incident Investigation Platform

GitHub

A centralized investigation platform that consolidates security telemetry and maps attacker paths to speed scoping and prioritization.

Impact & Implementation

Implementation

  • Built a centralized investigation platform consolidating multi-source security telemetry into structured incident workflows.
  • Implemented recursive attack path analysis across multi-domain logs to trace lateral movement and attacker progression.
  • Mapped attacker behavior to MITRE ATT&CK techniques for standardized investigation classification.
  • Designed automated enrichment and correlation pipelines to unify endpoint, network, and application telemetry.
  • Leveraged SIEM analytics to enable rapid blast-radius assessment and prioritization.

Impact

  • Reduced investigation time by ~40% through automated attack path mapping.
  • Saved 300+ analyst hours annually by reducing manual incident review effort.
  • Increased detection accuracy by 30% through correlated multi-source analysis.
  • Accelerated incident scoping and prioritization in enterprise-scale environments.
  • Improved analyst consistency by standardizing investigation workflows and telemetry correlation.

Threat Intelligence Feed Analyzer

GitHub

IOC matching + correlation across logs, enrichment links, and MITRE ATT&CK mapping for SOC-style investigations.

Impact & Implementation

Implementation

  • Built a log parsing workflow that ingests uploaded logs and normalizes events for analysis.
  • Implemented IOC matching against threat intelligence feeds to flag suspicious indicators across events.
  • Added correlation logic to highlight IOCs that appear multiple times across logs, supporting “case-style” investigation views.
  • Generated investigation-ready outputs that surface key evidence (matched IOC, event context, and frequency across logs).
  • Integrated enrichment as outbound links (VirusTotal / AbuseIPDB) to support fast analyst pivoting without blocking on API calls.
  • Built summary intelligence metrics including logs scanned, IOCs detected, high-risk IOCs, and top mapped MITRE tactics/techniques.

Impact

  • Speeds SOC investigations by turning raw logs into correlated IOC evidence with clear pivots and context.
  • Reduces manual effort by automatically surfacing repeat IOCs across multiple events and log sources.
  • Improves triage quality by pairing matched indicators with enrichment pivots (VirusTotal / AbuseIPDB) and analyst tagging.
  • Makes threat intel operational by mapping detected activity to MITRE ATT&CK tactics/techniques for quick classification.
  • Provides at-a-glance visibility into what matters most (high-risk IOCs, top tactics/techniques, overall scan coverage).

Cloud Incident Correlation and Detection (CIRC) Platform

GitHub

Cloud-based log ingestion and incident correlation with IOC matching, enrichment, and MITRE ATT&CK mapping for SOC investigations.

Impact & Implementation

Implementation

  • Built cloud log ingestion pipelines for AWS CloudTrail and VPC Flow Logs to support SOC-style investigations from cloud-native telemetry.
  • Implemented rule-based detection logic to flag suspicious activity patterns in CloudTrail and network flow activity.
  • Added IOC matching to identify known-bad indicators and connect them to relevant events and entities.
  • Correlated related alerts into structured incidents with severity scoring and contextual mapping to support investigation prioritization.
  • Integrated enrichment workflows and MITRE ATT&CK mapping to translate raw events into investigation context and attacker behavior framing.
  • Built a Streamlit analyst dashboard to surface incident timelines, evidence, and investigation-ready outputs with SOC workflow visibility.

Impact

  • Converts high-volume AWS logs into structured, investigation-ready incidents, reducing manual log stitching.
  • Improves triage quality by correlating related alerts into a single incident view with severity scoring and context.
  • Makes cloud activity easier to classify by mapping detections to MITRE ATT&CK, supporting consistent escalation decisions.
  • Speeds analyst workflows by combining detection, correlation, IOC matching, and enrichment into one investigation flow.
  • Provides SOC-style visibility through a Streamlit dashboard that supports prioritization and investigation handoff.

Advanced Threat Detection and Response Automation

GitHub

Automated threat detection pipeline with IOC matching, alert enrichment, and response-driven analytics for SOC environments.

Impact & Implementation

Implementation

  • Built a detection pipeline that analyzes security telemetry and flags suspicious activity using rule-based and analytic logic.
  • Implemented IOC matching to identify known-bad indicators and connect them to relevant events and entities.
  • Automated enrichment workflows to attach investigation context and pivot paths directly to alerts.
  • Generated structured alert outputs designed for SOC workflows, including clear evidence fields and response-ready context.
  • Organized detections and alert data to support fast triage, consistent escalation, and investigation handoff.

Impact

  • Reduces manual analyst effort by automating IOC matching and enrichment during triage.
  • Speeds investigations by turning raw telemetry into structured, response-ready alerts with clear context.
  • Improves consistency by standardizing how suspicious activity is detected, enriched, and packaged for response.
  • Supports faster decision-making by separating high-signal alerts from noisy activity.
  • Strengthens SOC workflows by producing outputs that map cleanly to investigation and response steps.

Skills

I work across the full detection lifecycle — threat modeling, detection development, tuning, validation, and response automation — with hands-on SOC investigation experience across endpoint, network, and application telemetry.

Detection Engineering & Threat Modeling

  • TTP-based threat modeling
  • MITRE ATT&CK mapping
  • Detection prototyping
  • Correlation logic (multi-source)
  • Validation in controlled test environments / test queues
  • Query optimization and threshold tuning
  • False positive reduction and signal refinement
  • Playbooks and enablement documentation

SOC Operations & Incident Response

  • Tier 1 alert triage
  • Investigation and escalation support (P1/P2)
  • Log correlation (firewall/DNS/HTTP/endpoint logs)
  • IOC validation and attacker behavior analysis
  • Containment actions (blocking, rule updates, privilege correction)
  • Incident reporting aligned to SLAs
  • SEV/on-call exposure (shadowing escalations)

SIEM / Querying / Analytics

  • Splunk (SPL)
  • Microsoft Sentinel (KQL)
  • Wazuh
  • SQL (large-scale datasets)
  • Log analysis and correlation across multi-source telemetry
  • Alert tuning and optimization

Network, Endpoint, and Forensics

  • Suricata IDS/IPS
  • FortiGate firewalls
  • Windows Event Logs
  • Linux syslogs
  • PCAP analysis
  • Outbound traffic and brute-force investigations

Threat Analysis, Malware, and Phishing

  • Static malware analysis (sandbox)
  • Dynamic malware analysis (sandbox)
  • IOC extraction and C2 behavior identification
  • Phishing header analysis
  • URL detonation and attachment sandboxing

Vulnerability & Security Testing

  • Nmap
  • Metasploit
  • Burp Suite
  • Vulnerability scanning and exploitability validation
  • OWASP Top 10 assessment support

Automation & Engineering

  • Response automation workflows (enrichment + evidence gathering + auto-close logic)
  • Python-based data pipelines
  • Enrichment engine (multi-source threat intelligence aggregation)
  • ML-driven analytics (project-based)

Contact

Want to connect about a role or collaboration? Send me a message — I respond quickly.

Email Me Connect on LinkedIn View GitHub