I design and run security operations on Microsoft Sentinel — detection pipelines, analytics rules, and automated response, built end to end from the log source to the containment playbook.
I'm a security engineer working in Azure. I run a detection-and-response stack end to end: Microsoft Sentinel over live telemetry, an internet-facing honeypot feeding a normalised CEF pipeline, a tuned analytics ruleset, and SOAR automation that triages and contains incidents with no human in the loop.
I work from the threat backwards. Every detection maps to a technique, every rule is validated against real data before it ships, and negative testing comes first — trigger the 403, confirm the gap, then close it. Every control is documented with the threat it addresses and how to verify it.
A deliberately exposed SSH decoy catching genuine attacker traffic, normalised into CommonSecurityLog through a four-layer pipeline. The attackers are real; only the target is fake.
_ResourceId column, which needed a full VM rebuild under a new identityA playbook that polls for active incidents, extracts the source IP from alert evidence, reputation-checks it, then blocks and closes as true/false positive with an investigation comment — no human approval step.
Ten analytics rules covering SSH brute force, unexpected interactive sessions, sensitive-credential-file access, port scans and network-scan-then-login correlation — each tuned against live data, not a 200 OK. Plus a 30-day structured training programme delivered to a small analyst group.