Cloud Security Engineer
Provided expert guidance on secure cloud configurations for clients including onboarding log sources, log optimization and, developing KQL queries to support Log Analytics workspace and Microsoft Sentinel, resulting in a number of new SIEM workbooks and alert rules.Led multiple concurrent Microsoft Sentinel SIEM deployments at a time.Standardized detection engineering efforts by creating & updating high level KQL ASIM functions for new data sources, enabling immediate coverage from 940+ use-cases.Built & managed Linux syslog forwarding servers per deployment enabling the monitoring offirewalls, WAFs, switches, IPS, IDS, and other Syslog/CEF based devices.Served multiple ServiceNow content requests a week, with a mean time to completion of 1 day for detection rules and 3 days for workbook dashboards and playbook automations.Reduced total log ingestion by 66%, utilizing workspace transformation data collection rules to dropnon-security relevant logs identified during cost optimization efforts.Advised client security teams of industry best practice configurations.