• Designed, implemented, and tuned Splunk detections to identify malicious and anomalous activity across email, endpoint, identity, and cloud data sources (Proofpoint, CrowdStrike, PingID, AWS).
• Translated incident response learnings and emerging threat patterns into high-impact detection logic, improving coverage for phishing, malware, URL-based threats, and identity abuse.
• Partnered with SOC, Incident Response, and Automation teams to operationalize detections and refine response strategies.
• Continuously assessed detection performance, reducing false positives and identifying coverage gaps across critical assets.
• Built and maintained SOAR automations in Cortex XSOAR, supporting development, testing, deployment, and ongoing maintenance.
• Served as a Tier 2/3 escalation point for complex security investigations.
• Integrated Proofpoint Email Security with Splunk and led migration from on-prem TRAP to Proofpoint Cloud Threat Response, developing IR playbooks and procedures.
• Documented detection logic, workflows, and response procedures; mapped detections to MITRE ATT&CK.
