Currently triaging enterprise security alerts at Investis Digital with a 30% false-positive reduction via ML tuning. Combines hands-on Blue Team operations with AI-augmented workflows, not just using AI tools, but building automation around them.
Dedicated SOC Engineer with 2+ years in enterprise security operations. Expert in blue team operations, AI-augmented threat detection, VAPT, DFIR, and cloud security across AWS environments. Gold Medalist with 9.47 CGPA in Forensic Science.
Experience
Associate SOC Engineer: Investis Digital Pvt Ltd
May 2024 – Present · Full-Time · Vadodara
Resolved 10,000+ security alerts using AI-assisted triage and Kibana SIEM
Reduced false positives by 30% via ML-based WAF rule tuning on Cloudflare
Conducted VAPT using Burp Suite, Nmap, Nessus across enterprise web apps
Monitored cloud infrastructure (AWS EC2, S3, CloudWatch) for security events
Blue Team Junior Analyst · SOC L1 & L2 (THM) · Multi-Cloud Blue/Red Team Analyst · ISO 27001:2022 Lead Auditor · (ISC)² CC · AWS Cloud Practitioner · CEH · DFE · and 32 more
aadityakgoswami@gmail.com
+91 97262 79007
Vadodara, Gujarat, India
Service Proposal
Prepared for: General Inquiry
Overview
What's Included
📄 Generate a Proposal
✕
Pick a service and (optionally) a name, a one-page proposal will be ready to print or save as PDF.
🎨
247profile views
🎬 60-Second Introduction: Aditya Kumar Goswami
🎥
Introduction Video
Upload your 60-second intro video here. This modal is wired up and ready.
Video introduction coming soon — recorded using the script below. Drop your YouTube or video file link to replace this placeholder.
Recommended: Record a 60-second Loom or screen-recorded video introducing yourself, your skills, and what you bring to a team. Recruiters spend 7s on resumes, give them 60s of you.
1–9 jump sections · T terminal · R resume · ? help
Securing the Enterprise.
Securing the Enterprise.Securing the Enterprise. Powered by AI.
Blue Team specialist with 2+ years in enterprise SOC, combining deep cybersecurity expertise with AI-driven automation to detect threats faster, respond smarter, and secure at scale.
Try: whoami · ls projects/ · cat skills.txt · sudo hire aditya · help
aditya@soc:~$
0
Alerts Resolved
0
Certifications
0
CGPA · Gold Medal
0
Years in SOC
akg@portfolio: interactive terminal
akg@portfolio:~$
AK
Aditya Kumar Goswami
Associate SOC Engineer · IDX
Status● Active & Available
AI ProficiencyAdvanced
ClearanceAvailable on Request
SOC Operations90%
AI & Automation85%
Cloud Security85%
Blue TeamDFIRAI SOCAWS
Enterprise clients I've protected as part of the Investis Digital security team
Rolls-Royce
Estée Lauder
Heineken
Diageo
M&G
Prosus & Naspers
Vodafone
TransUnion
Phoenix Group
+more
Rolls-Royce
Estée Lauder
Heineken
Diageo
M&G
Prosus
Vodafone
TransUnion
Phoenix Group
+more
* Logos shown as part of Investis Digital's client portfolio where I contributed to security operations. Not independent endorsements.
Before You Scroll Further
Not Your Typical SOC Resume
You've seen hundreds of cybersecurity profiles that look the same. Here's what's actually different about this one.
Typical SOC Profile
This Portfolio
Skills section
A bullet list of tools
Live security tools you can actually use, not just claims on a page
Proof of work
"Experienced in incident response"
A real anonymized case study, walked through step by step
AI claims
"Familiar with AI tools"
A working AI-assisted chatbot, phishing analyser, and malware report generator, try them above
Certifications
A static list of acronyms
40+ certs with one-click verification, holographic cards, filterable by category
Engagement
PDF you download once and forget
Live GitHub activity, real-time status, and a portfolio that updates itself
About
Enterprise Security. AI-Augmented Operations.
🥇
University Gold Medallist: CGPA 9.47 / 10.0
Awarded the highest academic distinction in B.Sc. Forensic Science (Cyber Forensics), graduating batch of 2024. Ranked #1 in the programme, combining academic excellence with hands-on industry practice from Day 1.
I am a dedicated cybersecurity professional with 2+ years of hands-on experience in enterprise Security Operations Centers, specializing in blue team operations, threat detection, and incident response.
At Investis Digital, I leverage both deep security expertise and modern AI tools to monitor, detect, and respond to threats across cloud and on-prem infrastructure, faster than traditional methods allow.
My approach blends human analytical judgment with AI-assisted automation: LLMs for threat report generation, AI-powered SIEM anomaly detection, and scripted workflows to reduce MTTR and eliminate alert fatigue.
I didn't fall into cybersecurity by accident. I went looking for the field where curiosity is actually an asset, not a liability. Every other discipline rewarded following the rules. Security rewards finding where the rules break.
2019First phishing lab
BScCyber Forensics
Chapter 02
The Moment
My first real moment came early — watching a live phishing campaign unfold against a college network. Realizing how fragile "secure" systems actually are when humans are involved. That gap between what a system promises and what it does became the thing I chased.
40+Certifications earned
🥇Gold Medal — Parul University
Chapter 03
The Edge
What keeps me here isn't the alerts or the dashboards — it's the asymmetry. One attacker needs one mistake. I need to be right every time. AI is finally tilting that balance back in the defender's favor.
2yr+Enterprise SOC
21Open-source tools built
Chapter 04
The Mission
I want to be one of the people who builds the AI-augmented future of defense — not just reacts to the threats of today. Detection engineering, agentic automation, and building tools that make defenders faster than attackers.
AEGIS7-source SIEM/SOAR initiative
∞Still building
Operating Philosophy
"I don't wait for alerts. I go looking for threats, and I let AI carry the noise so I can focus on the signal."
Every system in front of me is either compromised, about to be, or successfully defended, there is no neutral state in security.
Honest Reflection
Mistakes I've Learned From
Everyone shows their wins. Here are real moments where things went wrong — and what actually changed because of them.
01 / 05
I once closed an alert as a false positive that wasn't.
Early in my SOC career, I dismissed a low-severity alert — odd PowerShell execution on a single endpoint — because it matched a known noisy pattern from an IT script. It wasn't. It was the first stage of a dropper that sat dormant for several days before attempting lateral movement. We caught it during a routine threat hunt, not because the alert worked as intended.
What changed: I stopped trusting pattern-matching alone for triage decisions. Now any alert involving script execution gets a process-tree check before closure, regardless of how "normal" the parent process looks.
02 / 05
I over-tuned a detection rule and created a blind spot.
Trying to cut false positives on a noisy brute-force rule, I added a condition requiring failed attempts from a single source IP in a tight window. False positives dropped sharply — but a slow, distributed credential-stuffing attempt using rotating IPs sailed through undetected for almost a week.
What changed: False-positive reduction and detection coverage are a trade-off. Every tightened rule now goes through a "what would this miss?" review before deployment, not just "does this reduce noise?"
03 / 05
I underestimated the blast radius of a compromised service account.
A service account flagged in a routine password audit was deprioritized because it appeared to have limited permissions. It had inherited elevated rights through a nested group that wasn't documented. Before remediation, the account was used in a lateral movement attempt that required emergency containment at 11 PM.
What changed: Service account audits now include recursive group membership checks and privilege inheritance mapping — not just direct permission review. Every account gets a quarterly blast-radius assessment.
04 / 05
I deployed a detection rule to production without staging.
Eager to close a detection gap, I pushed a new Sigma rule for suspicious scheduled task creation directly to production. Within two hours, the help desk was flooded — the rule triggered on a legitimate IT automation tool that creates scheduled tasks normally.
What changed: All detection rules now go through a three-environment pipeline — dev → staging (with sanitized real data, minimum 48 hours) → production. No exceptions.
05 / 05
I communicated a critical finding to a non-technical stakeholder — technically.
After identifying a critical cloud storage misconfiguration, I wrote a finding dense with CVSSv3 scores and exploitability metrics. The business owner filed it as low priority. It sat unresolved for six weeks. Nothing was wrong with the finding — everything was wrong with the communication.
What changed: Technical findings now come with a business impact translation — "an attacker could access X customer records" rather than "CVSS 9.1 AV:N." The technical detail lives in an appendix. The summary speaks revenue, compliance risk, and reputational damage first.
Behind the Dashboard
A Day in My SOC
What "SOC Engineer" actually looks like, hour by hour, for anyone who's never sat behind the glass. A real day touches a dozen tools, three security domains, and AI runs through almost all of it.
07:45
☕
Shift Handover & Overnight Triage
Review overnight alerts queued across Kibana, Wazuh, and Microsoft Sentinel. Cross-check Suricata and Sysmon telemetry, prioritize by severity using risk-based alerting, and flag anything needing escalation before the team standup.
KibanaWazuhSentinelSuricataSysmon
08:30
🌅
Morning Planning, AI-Assisted
Before diving into tickets, I ask Gemini and ChatGPT to summarize overnight CVE disclosures relevant to our stack and draft a rough priority order for the day. Five minutes of AI delegation that used to take 30 minutes of manual reading.
GeminiChatGPTCVE Feeds
09:15
🔍
Proactive Threat Hunt
Hunt for IOCs and anomalous behavior patterns automated rules might miss, mapped against MITRE ATT&CK TTPs. Correlate IOC/IOA-based detections across SumoLogic and Log360, building or refining use-cases as patterns emerge.
MITRE ATT&CKSumoLogicLog360
10:30
☁️
Cloud & WAF Posture Review
Check Azure and AWS (EC2, S3, CloudWatch, IAM) for drift, review Defender XDR alerts, and audit Cloudflare WAF and Akamai rules. Update IP blacklisting and DDoS mitigation thresholds as new threat intel comes in from Site24x7.
AzureAWSDefender XDRCloudflare WAFAkamai
11:30
⚙️
SIEM Rule & Correlation Tuning
Refine correlation rule logic and Wazuh ML baselines to cut false positives without losing real signal. This is where the 30% FP reduction came from, scripted and validated using Python and PowerShell before deployment.
Wazuh MLPythonPowerShell
12:30
🥗
Lunch, AI Runs in the Background Too
Even off the clock, AI shows up: I'll ask Claude or Gemini to summarize a long article I didn't have time to read, draft a quick reply email, or plan a workout split. Same tools, completely different problem space.
ClaudeGemini
13:15
🤖
AI-Assisted Log Correlation
Use ChatGPT and Gemini to accelerate log correlation across Windows Event Logs, Syslog, firewall, EDR/XDR, proxy, and cloud logs, summarize TTPs, and draft the technical sections of incident reports before I review and tighten them.
ChatGPTGeminiWindows Event Logs
14:15
🛡️
VAPT & Vulnerability Validation
Run targeted scans and manual checks with Nessus, Nmap, Burp Suite, OWASP ZAP, and SQLMap. Validate findings against Metasploit where exploitation needs confirming, then document severity using CVSS-aligned scoring.
NessusNmapBurp SuiteOWASP ZAPSQLMapMetasploit
15:30
🚨
Incident Response, When It's Real
When something real fires, contain, collect evidence with Wireshark and Autopsy, eradicate, and document the timeline in The Hive while it's fresh. Cross-reference indicators against MISP for related campaign activity.
WiresharkAutopsyThe HiveMISP
16:30
📋
GRC & Compliance Work
Rotate into GRC tasks: mapping controls against ISO/IEC 27001:2022, NIST, and CIS benchmarks, checking Bitsight ratings, and updating RCA documentation and tickets in Jira and Confluence for ongoing audits.
ISO 27001NISTCISJiraConfluence
17:30
📊
Reporting & Handover
Compile the day's findings into stakeholder-ready reports using AI to draft the first pass and cut documentation time significantly, update playbooks in The Hive, and brief the next shift on anything still open.
ReportingThe HiveAI Drafting
19:00
📚
Evening: Learning & Side Projects
Most evenings go to certifications, CTF practice, or building small automation scripts. AI shows up again here too, helping me scaffold Python tooling faster or explain a concept I want to go deeper on, this time entirely self-directed.
PythonBashSelf-Study
Career Journey
Interactive Timeline
Drag to explore, click any milestone for details.
2021
B.Sc. Forensic Science
Cyber Forensics Track
🎓 Degree
Apr 2023
Computer Forensic Analyst
Regional Forensic Lab
🔬 Forensics
May 2023
Cybersecurity Analyst
Cyber Octet Pvt Ltd
🛡️ Intern
Nov 2023
SOC Analyst
Chaitanya Cyber Strix
🔍 SOC
Dec 2023
Compliance Intern
Sannibh Technologies
📋 GRC
Dec 2023
Cybersecurity Intern
Cyber Secured India
⚔️ VAPT
2024
Gold Medal: 9.47 CGPA
B.Sc. Graduation
🥇 Gold
2024 to 2026
M.S. Cybersecurity
Postgraduate Degree
🎓 Masters
May 2024 to NOW
Assoc. SOC Engineer
Investis Digital (IDX)
● Current
Skills
Technical Expertise
Skills Radar
Capability Overview
Deep expertise across the full security spectrum, from proactive threat hunting and incident response to cloud security architecture and compliance auditing. AI amplifies every domain.
SOC Operations
Threat Monitoring90%
Incident Response85%
Log Analysis90%
SIEM Management85%
KibanaWazuhSplunkSumoLogicSuricata
VAPT
Web App Security75%
Network Scanning80%
Vulnerability Assessment85%
Burp SuiteOWASP ZAPNmapNessusSQLMap
DFIR
Digital Forensics80%
Incident Investigation85%
Malware Analysis75%
AutopsyFTKThe HiveMISPWireshark
GRC
Compliance Auditing80%
Risk Assessment75%
Policy Development70%
ISO 27001NISTCIS ControlsBitsight
AWS Cloud
AWS Security85%
EC2S3CloudWatchWAFIAM
Azure
Azure Security60%
Virtual MachinesSecurity Center
🌐
Skill visualization — enable WebGL to see the 3D globe
I don't just use AI tools, I build with them. This section covers how AI fits into actual SOC workflows, the full toolkit I rely on day to day, and the automation I've built on top of it, including agentic workflows that go beyond simple prompting.
🤖
Why AI in Cybersecurity?
AI doesn't replace the analyst, it amplifies them. I use AI to eliminate noise, surface real threats, generate reports instantly, and automate repetitive tasks, freeing time for strategic defence work.
⚡
My AI-First SOC Approach
Every alert I investigate starts with AI-assisted context enrichment. LLMs summarize threat intel, Copilot accelerates detection rule development, and ML anomaly detection catches what rule-based systems miss entirely.
Core AI Platforms I Work With
🧠
ChatGPT & Claude
LLM Analysis & Reporting
Analyze suspicious log patterns, generate incident reports in minutes, summarize threat intel from multiple feeds, draft playbook documentation and explain malware behaviour to stakeholders.
Incident ReportsThreat IntelLog Interpretation
✨
Google Gemini
Multimodal Analysis & Research
Use Gemini's long-context window for analyzing lengthy compliance documents, cross-referencing multiple CVE advisories at once, and multimodal review of screenshots from phishing or alert investigations.
Long-Context AnalysisDocument ReviewMultimodal
📊
AI-Powered SIEM
Anomaly Detection & Correlation
Kibana ML modules and Wazuh AI anomaly detection baselines normal behaviour across thousands of endpoints, surfacing genuine outliers that rule-based systems miss entirely.
Anomaly DetectionUEBAML Correlation
💻
GitHub Copilot
Security Automation & Scripting
Accelerate Python security scripts: automated IOC extraction, log parsing pipelines, API integrations with threat intel feeds, and custom detection rules, all built faster with AI pair programming.
Python ScriptsIOC ExtractionDetection Rules
🔗
n8n Workflow Automation
Agentic & No-Code Automation
Build agentic automation pipelines connecting SIEM alerts, threat intel APIs, and LLM reasoning steps, so routine triage and enrichment runs without me touching it manually.
Agentic AIWorkflow AutomationAPI Orchestration
🦠
VirusTotal AI & SOCRadar
Threat Intelligence & Malware Analysis
AI Code Insight explains obfuscated malware scripts in plain language, while SOCRadar's AI-enriched threat intelligence pinpoints campaign infrastructure faster than manual pivoting.
Malware AnalysisThreat Intel
🔍
Perplexity AI
Research & Threat Intel Synthesis
Use Perplexity for real-time threat actor research, CVE deep-dives, and synthesizing information across multiple sources with citations — the fastest way to build context on an emerging threat campaign.
ResearchCVE AnalysisThreat Actor Intel
🛡️
Microsoft Security Copilot
Enterprise SOC AI Assistant
Microsoft Security Copilot integrates with Sentinel, Defender, and Purview — enabling natural language threat hunting, incident summarization, and guided IR playbook execution directly within the Microsoft security stack.
SentinelDefender XDRIncident Summary
🧬
OpenAI o1 & GPT-4o
Advanced Reasoning & Multimodal Analysis
GPT-4o analyzes phishing screenshots, malware UI, and network diagrams visually. o1's extended reasoning model excels at complex multi-step security analysis — breaking down attack chains and evaluating detection logic step by step.
ReasoningVision AnalysisChain-of-Thought
🌐
CrowdStrike Charlotte AI & Darktrace
AI-Native EDR & NDR
Charlotte AI provides conversational threat hunting across the Falcon platform. Darktrace uses unsupervised ML to detect subtle anomalies in network behaviour that signature-based tools miss entirely.
EDRNDRUnsupervised ML
✨
Google AI Studio & Gemini Deep Research
Compliance Research & Long-Context Analysis
Gemini Deep Research autonomously browses and synthesizes security frameworks, compliance standards, and threat reports — dramatically accelerating GRC work and policy research that used to take hours.
GRC ResearchDeep Research
Where AI Fits in the Detection Lifecycle
🔍
DETECT
AI anomaly detection flags unusual behaviour in SIEM
🧠
ENRICH
LLM pulls IOC context from threat intel feeds automatically
⚡
TRIAGE
AI scores severity; analyst reviews high-priority queue only
🛡️
RESPOND
Automated playbook executes containment actions
📋
DOCUMENT
AI generates full incident report & Jira ticket in seconds
Measured Impact
70%
Faster Incident Report Generation with LLMs
30%
Reduction in False Positives via ML Tuning
5×
Faster Detection Rule Dev with Copilot
18min
Mean Time to Detect (down from 4 hrs)
AI & ML Knowledge Base
Prompt EngineeringLLM-Assisted Threat AnalysisML Anomaly DetectionUEBAAI-Powered SIEMAutomated PlaybooksPython Security AutomationNLP for Log AnalysisGitHub CopilotChatGPT APIGPT-4o VisionGPT-4o Minio1 Reasoning Modelo3-miniOpenAI Deep ResearchClaude 3.5 SonnetClaude 3 OpusClaude APIClaude CodeGemini 1.5 ProGemini FlashGemini Deep ResearchGoogle AI StudioGoogle NotebookLMPerplexity AIPerplexity Deep ResearchPerplexity Pro SearchGrok 3Mistral LargeAI-Assisted ForensicsGenerative AI ReportingAgentic AI Workflowsn8n AutomationRAG PipelinesVector DatabasesLangChainMicrosoft Security CopilotCopilot for SecurityCopilot for M365Darktrace AIVectra AI NDRSentinelOne AICrowdStrike Charlotte AIRecorded Future AIAnalyst1 AIVirusTotal IntelligenceShodan AIElastic AI AssistantWazuh ML RulesHugging Face ModelsAnthropic WorkbenchOpenAI PlaygroundMeta AI LlamaDeepSeek R1Google NotebookLMGrok 3Grok Deep SearchMicrosoft Copilot StudioCanva AI MagicNotion AIPoe.comAI21 Labs JambaCohere Command R+Anthropic ProjectsOpenAI ProjectsClaude ArtifactsGemini WorkspaceAI Security CopilotVectra AISentinelOne Purple AIPalo Alto XSIAM AI
AI Tools I Use Daily: Interactive
Click each tool to see exactly how I use it in real SOC workflows.
ChatGPT & Claude: LLM Analysis
I use large language models daily to accelerate incident analysis, generate reports, and summarize threat intelligence in seconds rather than hours.
Summarize MITRE ATT&CK TTPs for a detected threat actor in 60 seconds
Draft post-incident reports from structured notes. 75% time savings
Explain malware behaviour to non-technical stakeholders in plain language
Generate Kibana KQL queries and Sigma detection rules from a description
Cross-reference CVE advisories and build remediation briefings
75%
Reduction in report writing time
60s
Average TTP summary generation
Daily
Active usage in SOC workflow
Gemini: Long-Context & Multimodal Analysis
Gemini's long-context window handles things ChatGPT and Claude conversations sometimes can't hold in one pass, especially when cross-referencing lengthy compliance documents or multiple CVE advisories simultaneously.
Cross-reference 5+ CVE advisories at once for a single patch decision
Review full ISO 27001 policy documents in one pass without chunking
Multimodal review of phishing email screenshots and alert dashboards
Summarize entire incident timelines from raw exported logs
Morning briefing: summarize overnight CVE disclosures before shift starts
1M+
Token context for large documents
Daily
Morning CVE briefing routine
Multimodal
Screenshot & document review
GitHub Copilot: Security Automation
I use Copilot as an AI pair programmer to accelerate Python security scripts, detection logic, and automation tooling, turning hours of coding into minutes.
Automate IOC extraction from raw log files using regex + API calls
Generate Suricata/Snort rules from threat descriptions
Python scripts for AWS CloudTrail anomaly detection
Accelerate detection rule development 5× over manual coding
5×
Faster detection rule development
Python
Primary automation language
12+
Custom automation scripts built
n8n: Agentic Workflow Automation
I build agentic automation pipelines in n8n that chain SIEM alerts, threat intel API calls, and LLM reasoning steps together, so routine enrichment and triage runs without me manually touching every alert.
Agent pipeline: new alert → auto-enrich IOC via VirusTotal/SOCRadar API → LLM severity scoring → Jira ticket if high-risk
Scheduled agent that pulls overnight CVE feeds, filters by relevance to our stack, and posts a summary to Slack
Multi-step agent for phishing triage: extract URLs → check reputation → LLM verdict → auto-quarantine if malicious
Webhook-triggered workflows connecting Kibana alerts directly to automated response actions
Currently expanding into more autonomous, multi-tool agent chains beyond simple linear workflows
Agentic
Multi-step automation, not just scripts
No-Code
+ custom code nodes where needed
24/7
Triage runs even when I'm offline
AI-Powered SIEM: Kibana & Wazuh
I leverage ML modules in Kibana and Wazuh to baseline normal behaviour across thousands of endpoints, surfacing genuine anomalies that rule-based systems miss.
Kibana ML anomaly detection for user behaviour (UEBA)
Wazuh ML rules reduced MTTD from 4 hours to 18 minutes
Correlated ALB, Cloudflare CDN, and IIS logs to detect coordinated attacks
Built custom dashboards for executive threat visibility reporting
Tuned ML baselines to reduce false positives by 30%
18min
MTTD (down from 4 hours)
30%
False positive reduction
3
Log sources correlated in real-time
SOCRadar: External Threat Intelligence
I use SOCRadar for external threat intelligence enrichment, identifying threat actor infrastructure, tracking campaigns, and enriching IOCs beyond what internal tools surface.
Linked attack IPs to known credential-stuffing-as-a-service groups
Identified 3 additional client targets in the same threat actor campaign
Dark web monitoring alerts for client data exposure
TTP profiling combined with LLM summarization for rapid stakeholder reporting
5min
Full TTP summary generation
Real-time
Threat actor infrastructure tracking
Dark Web
Data exposure monitoring
VirusTotal AI: Malware & IOC Analysis
Daily use for rapid IOC enrichment, scanning suspicious files, URLs, IPs and domains against 70+ AV engines and AI-assisted code analysis during triage.
Rapid hash lookups during alert triage. 30-second IOC enrichment
Sandbox detonation and behaviour analysis for suspicious attachments
URL reputation checks for phishing investigation workflows
AI Code Insight feature to explain obfuscated malware scripts
Pivoting from one IOC to discover related threat actor infrastructure
70+
AV engines in scan pipeline
30s
Average IOC enrichment time
AI
Code Insight for malware analysis
Perplexity AI: Real-Time Threat Research
Perplexity's real-time web search combined with AI synthesis makes it the fastest tool for threat actor research, CVE deep-dives, and building context on emerging campaigns — with citations I can verify instantly.
Research threat actor TTPs with real-time source verification in under 2 minutes
Deep-dive any CVE — affected versions, PoC status, patch availability
Build threat context reports on active campaigns before standup
Cross-reference CISA advisories with vendor security blogs for full picture
Perplexity Pro Deep Research for full GRC framework comparison reports
Real-time
Web-grounded research with citations
2 min
Average threat actor context build
Daily
Morning threat briefing routine
Microsoft Security Copilot: Enterprise SOC AI
Security Copilot integrates natively into Sentinel, Defender XDR, and Purview — enabling natural language threat hunting, incident summarization, and guided playbook execution across the full Microsoft security stack.
Natural language KQL — describe a hunt in English, Copilot writes the query
One-click incident summarization: entities, timeline, MITRE mapping in seconds
Defender XDR guided IR — step-by-step remediation with full context
Intune/Purview compliance investigation across M365 tenant
Threat intelligence enrichment from Microsoft's global security telemetry
Native
Sentinel + Defender XDR integration
NL KQL
Natural language threat hunting
60s
Incident summary generation
Google NotebookLM: Deep Document Intelligence
NotebookLM transforms lengthy security documents — frameworks, threat reports, compliance standards — into interactive Q&A sessions and structured summaries. The fastest way to consume NIST, ISO, and vendor advisories.
Load full NIST SP 800-53 or ISO 27001 — ask targeted control questions instantly
Summarize Mandiant/CrowdStrike threat reports into SOC-relevant bullet points
Build study notes from multiple CVE advisories in a single shared notebook
Create audio overviews of threat intel reports for hands-free commute review
Cross-reference multiple compliance frameworks in one conversation
Multi-doc
Cross-document intelligence synthesis
Audio
Hands-free threat report review
GRC
Primary framework research tool
🌐 AI Isn't Just a Work Tool for Me
The same models I use for threat analysis show up everywhere else too: drafting and tightening writing, planning workouts, summarizing long articles I don't have time to read in full, and learning new technical topics faster by asking Claude or Gemini to explain something three different ways until it clicks. Treating AI as one consistent skill rather than a job-specific tool is, I think, exactly why I stay comfortable picking up new AI tools quickly, the underlying habit of delegating well and verifying critically transfers everywhere.
Try It Yourself
Live Security Tools
An AI assistant trained on my background, and a set of genuinely hard technical questions for anyone who wants to test my knowledge directly.
🤖 Ask About Aditya Pre-loaded with resume data
Ask anything about skills, certifications, experience, or how to get in touch. Try one of the suggestions below.
🤖
Hi! I'm an AI assistant trained on Aditya's resume, certifications, and project history. Ask me anything, try a suggestion below to get started.
What certifications does he have?Can he handle AWS security?Can he handle a ransomware incident?How do I hire him?What AI tools does he use?
🧠 Stump Me Direct technical vetting
This isn't a generic chatbot demo, it's a bank of genuinely hard SOC, DFIR, and cloud security questions with real answers. Pick one and judge for yourself.
Select a question above to see the answer
Case Study
Real Incident Deep-Dive
A walk-through of a real enterprise threat I detected, investigated, and resolved, anonymized for confidentiality.
01
Initial Detection
Anomalous WAF traffic pattern triggers Cloudflare alert at 02:14 AM
02
Log Analysis & Triage
Kibana SIEM correlation across ALB, CDN, and IIS logs reveals coordinated attack
03
Threat Intelligence
SOCRadar identifies threat actor infrastructure; ChatGPT used to summarize TTPs
04
Containment & Response
IP blocks deployed, WAF rules updated, PagerDuty incident escalated
05
Post-Incident Report
LLM-generated draft reviewed and submitted within 40 minutes of resolution
STEP 01: DETECTION
Coordinated DDoS + WAF Evasion Attack
At 02:14 AM, Cloudflare WAF flagged a 340% spike in requests targeting a client's login endpoint from 47 distinct ASNs, a classic distributed low-and-slow credential stuffing pattern designed to evade volume-based thresholds.
Attack vector: Credential stuffing via rotating residential proxies
Target: Enterprise e-commerce login page across 3 regions
Volume: ~18,000 requests/minute at peak
Evasion technique: Varied User-Agent strings and request timing
18K
Req/min at peak
47
Distinct ASNs
🔧 The Detection Rule That Came Out of This Incident
After this attack, the existing WAF rule was too broad and generated noisy false positives. Here's the actual before/after.
14+action: challenge(type=js_proof_of_work) // soft block before hard block
15+escalation: block_ip(duration=300s) // only after challenge failure
Why this mattered: the original rule blocked by single IP, which is useless against rotating residential proxies. The fix clusters by ASN behavior and adds a JS proof-of-work challenge as a soft gate before a hard IP block, legitimate users pass invisibly, automated clients get stuck on the challenge.
Deep Dive Case Studies
Real Incident Analysis
Detailed post-incident analysis of major cybersecurity events — combining public information with SOC-perspective investigation methodology. All cases use real documented incidents.
🔴 P1 — Critical
June 2022 · Real Incident
Cloudflare BGP Route Leak — Global Service Disruption
Incident Scenario
A Cloudflare network partner accidentally announced a subset of Cloudflare's IP prefixes to their upstream BGP peers without proper filtering. The leaked routes propagated globally, causing major traffic disruption for approximately 50 minutes affecting millions of users.
SOC Investigation Timeline
T+0:00Anomaly detected — sudden spike in latency alerts across CDN monitoring. Multiple customers reporting connectivity failures.
T+0:08Network team identifies BGP route anomalies. Traceroutes showing unexpected ASN hops — traffic being misrouted through unknown autonomous systems.
T+0:22Root cause identified: BGP route leak from transit partner. NOT a cyberattack. Containment begins — affected prefixes withdrawn.
BGP anomalies require a dedicated runbook — they look like attacks but often aren't. Misclassification wastes critical response time.
RPKI (Resource Public Key Infrastructure) validation prevents route leak propagation — a must-have for any organization operating internet infrastructure.
Distinguish between infrastructure disruption and security incident from the first alert — the response playbooks are fundamentally different.
🟡 P1 — High
January 2023 · Real Incident
Microsoft 365 Worldwide Outage — WAN Routing Change
Incident Scenario
A WAN routing configuration change deployed by Microsoft caused widespread Microsoft 365 service degradation globally. Exchange Online, Teams, SharePoint Online and Outlook were affected for enterprise customers across multiple continents for approximately 3–4 hours.
SOC Investigation Timeline
T+0:00Help desk flooded with email and Teams access failures. SIEM shows authentication anomalies — Azure AD sign-in failures spiking across tenant.
T+0:15SOC initially investigates as potential credential stuffing attack. Hunt reveals failures are global, not user-specific — eliminates targeted attack hypothesis.
T+0:30Microsoft Service Health Dashboard confirms widespread outage. SOC pivots from attack investigation to business continuity response.
T+3:50Microsoft rolls back WAN configuration change. Services restored progressively. Post-incident review initiated.
MITRE ATT&CK Relevance
T1486 – Data Encrypted for Impact (initial hypothesis)T1531 – Account Access RemovalCloud Resilience Planning
Key Lessons for SOC Teams
Mass authentication failures are ambiguous — always check vendor status pages before escalating to incident response. False incident classification is expensive.
Cloud dependency creates shared-fate scenarios. A single provider outage can simultaneously affect email, collaboration, authentication, and backup systems.
Business continuity playbooks for cloud provider outages must be tested regularly — most organizations only discover gaps during actual outages.
A threat actor uses LLM-generated, contextually personalized phishing lures combined with credential stuffing from a recent data breach. Rotating proxy infrastructure defeats rate-limiting. Authentication anomaly detection initially misses the slow, distributed attack pattern.
SOC Investigation Timeline
T+0:00Wazuh alert: unusual login geography for 3 accounts. Each account shows single successful auth from new country — individually below threshold, collectively suspicious.
T+0:25Correlation query reveals 47 accounts with similar pattern over 6 hours. MISP lookup: source IPs match known credential stuffing infrastructure. Incident declared.
T+4:00Root cause confirmed via threat intel: credentials from 2024 breach of third-party HR platform. Vendor notified. All affected users required password reset.
Individual threshold-based alerts miss distributed attacks. Correlation rules that look at patterns across accounts over time are essential for credential stuffing detection.
Threat intelligence integration is not optional — without the MISP IOC lookup, this investigation would have taken 4x longer to attribute.
MFA is your last line of defense after credentials are compromised. Universal MFA enforcement is non-negotiable in 2026.
Hands-On Proof
Home Lab Architecture
This isn't theoretical — I built and operate this stack. Click any node to see its config, version, and what detection rules run on it.
👆
Click any node to see details
Intelligence Operations
Threat Intelligence Dashboard
A real-time simulation of the kind of threat intelligence environment I operate in daily, tracking IOCs, MITRE ATT&CK TTPs, and global attack vectors.
🔴 Critical Threats
0
Active CVEs being exploited in the wild
↑ 14% this week
🛡️ Alerts Resolved
~10K
Lifetime enterprise security alerts triaged
↓ 30% FP rate via ML tuning
⚡ Mean Time to Detect
18min
AI-augmented MTTD (down from 4 hours)
↓ 93% improvement
🗺️ MITRE ATT&CK Framework Coverage Tactics I actively monitor & respond to
Offensive Research
CTF & HackTheBox Achievements
Hands-on offensive security practice, sharpening red team skills to build a stronger blue team mindset.
8+
Machines Pwned
8
CTF Events Participated
Top 1%
TryHackMe Ranking
HoLmes
HTB CTF 2025 Cert
🟢
Hack The Box
Offensive Labs · CTF Competitions
HoLmes CTF 2025
Forensics · Web · OSINT
Certified ✓
Web Exploitation Labs
SQLi · XSS · SSRF · LFI
5 Solved
Forensics Track
Memory · Disk · Network PCAP
3 Solved
🧩 Web🔬 Forensics🕵️ OSINT
🔴
TryHackMe
Blue & Red Team Learning Paths
SOC Level 1 & 2
Alert Triage · SIEM · Threat Intel
Completed ✓
Jr Penetration Tester
Web · Network · Exploitation
Completed ✓
Advent of Cyber
Annual 25-day challenge
Top 1%
Global RankingTop 1%
🛡️ Blue Team⚔️ Red Team☁️ Cloud
Achievements
Trophy Wall
A scannable snapshot of the milestones that took years to earn, compressed into one wall.
🥇
9.47
University Gold Medal
Gold Medallist
Graduated as Institute Topper with 9.47 CGPA in BSc Cyber Forensics — Parul University, 2023.
🌟
Rising Star
Performance Award · IDX
Rising Star Award
Awarded by Investis Digital for exceptional performance and measurable security impact within first year.
⚡
10K+
Security Alerts Triaged
Alert Operations
Over 10,000 security alerts triaged across Wazuh, Kibana, Suricata, and Microsoft Sentinel in 2 years.
🚩
CTF
HoLmes HTB 2025
HackTheBox CTF
Competed in HoLmes CTF 2025 on Hack The Box — certificate earned for successful completion.
🏆
40+
Industry Certifications
Certification Portfolio
40+ certifications spanning SOC, VAPT, DFIR, GRC, Cloud — from EC-Council, ISC2, AWS, Cisco & more.
🎯
18 min
AI-Augmented MTTD
Detection Speed
Reduced Mean Time to Detect from 4 hours to 18 minutes using AI-assisted triage and automated enrichment.
📉
30%
False Positive Reduction
ML Tuning Impact
Reduced alert false positives by 30% through ML-based anomaly baseline tuning and rule refinement.
🛡️
AEGIS
Internal SIEM/SOAR Lead
AEGIS Initiative
Led detection content for AEGIS — 7 log sources, MITRE ATT&CK mapped, integrated across SIEM & SOAR.
🐙
21
Open-Source Tools Built
GitHub Portfolio
21 public cybersecurity repositories covering AI SOC, detection engineering, GRC, cloud security & SOAR.
🎓
MSc
Cybersecurity · Gold
Postgraduate Degree
MSc in Cybersecurity — continued academic excellence following the BSc gold medal at Parul University.
Work With Me
Services & Engagements
Freelance security work, mentorship, and training, drawn directly from real SOC and offensive research experience.
Open to freelance, 3 project slots available this month
🛡️
VAPT Assessment
Web app, network & API penetration testing with a full remediation report mapped to OWASP Top 10.
Ongoing SOC coverage for teams that need expert eyes-on-glass without a full-time hire — from lightweight threat intel briefings to full SIEM monitoring and IR SLA.
Every repository is public, MIT licensed, and built with real code — not mockups. Scroll sideways through featured projects or filter the full list below.
Checks whether Sigma rules actually catch the real Atomic Red Team tests they claim to detect. Honest gap analysis between detection claims and reality.
All 24 major SIEM platforms researched and compared, with a real verified Sigma-to-native-query converter for 6 of them — Splunk, Elastic, CrowdStrike and more.
Hands-on red team project covering WAF detection, bypass techniques, and web application VAPT — from a blue team perspective to build stronger defenses.
Anonymized collection of real SOC incidents — investigation timelines, MITRE ATT&CK mapping, containment steps, and lessons learned from enterprise environments.
WAF bypass techniques & mitigation research — blue team perspective on red team tooling
HTMLRed Team · VAPT
VishGuard
Social-engineering pattern detection and enforced out-of-band verification for vishing / deepfake-era phone fraud
PythonFraud Detection
Kibana-SIEM-Dashboard-Demo
Detect brute force login attacks using Kibana with sample Linux logs — detection dashboard demo
VariousSIEM
ReconVeritas-Automated-Recon-Tool
Advanced fully automated reconnaissance framework for red teamers, consolidating top open-source recon tools
PythonOSINT · Recon
SOC-Lab-Open-Source-Setup
Full open-source SOC lab: Wazuh, Suricata, Kibana, TheHive, Cortex, MISP, Grafana — complete home lab guide
ShellSOC Lab
SOC-Incident-Case-Study
Anonymized collection of security incidents with MITRE ATT&CK mapping and complete forensic timelines
MarkdownDFIR · IR
Kibana-SIEM-Dashboard-Demo
Brute-force detection dashboard with custom ML rules in Kibana using sample Linux authentication logs
ShellSIEM · Kibana
Wireshark-HTTP-Credential-Capture
Capture login credentials from HTTP traffic using Wireshark packet analysis — educational network forensics lab
PythonNetwork Forensics
Insights & Research
Articles, CTF Writeups & Talks
Original research, CTF writeups, case studies and practical guides from the frontlines of enterprise security operations. Published on LinkedIn and Medium — with a full speaking track opening in 2026.
📰 Now Live on Medium
Long-form technical breakdowns, incident retrospectives, and AI-in-cybersecurity deep-dives. Follow on Medium for new posts every week.
Zero Trust shifts security from the traditional perimeter-based model to an identity-centric "never trust, always verify" framework. After implementing Zero Trust principles at Investis Digital, here's what the data showed after 90 days:
→ Micro-segmentation limited lateral movement. APT dwell time dropped 68%
→ MFA + behavioral analytics reduced credential-based attacks by 73%
→ Wazuh ML rules brought MTTD from 4 hours down to 18 minutes
The Art of Proactive Threat Hunting: From Reactive SOC to AI-Augmented Hunter
+
Most SOC teams are purely reactive, they wait for alerts. This piece documents my transition to proactive threat hunting using AI-generated hypotheses and ML-driven anomaly baselining. Two real discoveries from production environments:
→ DGA pattern in DNS queries surfaced a malicious npm package, no alert had triggered
→ Exposed S3 bucket with customer PII found via automated OSINT sweep before any breach
Cloud Security Blind Spots: 5 AWS Misconfigurations That Led to Real Breaches
+
After analyzing 200+ cloud security incidents, the pattern is consistent: most breaches aren't zero-days, they're misconfigurations that existed for months. Here are the five I see repeatedly in the wild, and exactly how to prevent each:
1. IAM Permission Sprawl: an 18-month-old API key caused a full data exfiltration
2. CloudTrail disabled silently, attacker turned off logging before launching crypto-miner
3. Public S3 exposure. Block Public Access + automated Prowler scanning prevents 90%
4. Security group 0.0.0.0/0, replaced SSH with Systems Manager entirely
5. AI automation (Lambda + Config + Security Hub) catches misconfigs within 4 minutes
What Actually Changes When You Put an LLM Inside a SOC Workflow
+
There's a lot of hype and very little specificity about AI in security operations. This piece breaks down exactly where LLMs help, where they don't, and what changed measurably after a year of using them daily:
→ Report drafting time dropped 70%, but every output still needs a human review pass
→ LLMs are excellent at summarizing known patterns, weak at flagging genuinely novel attacker behavior
→ The real win was agentic automation (n8n) chaining tool calls together, not chat-based Q&A
→ Verification discipline matters more with AI in the loop, not less
ISO 27001:2022 in Practice: What the Audit Doesn't Tell You
+
Passing an ISO 27001 audit and actually running a secure organization are two different things. After supporting a full audit cycle, here's where the framework's checklist nature creates blind spots:
→ Documented controls and operationally enforced controls are not the same thing
→ RCA documentation quality predicted audit friction better than control maturity did
→ Mapping NIST and CIS alongside ISO closed gaps the ISO checklist alone missed
→ The teams that treated GRC as a living process, not an annual event, audited the smoothest
Building an Agentic SOC: What n8n Automation Actually Looks Like in Production
+
My first long-form Medium piece, currently in progress: a real walkthrough of the n8n agent pipelines I run for alert enrichment and triage, including the parts that didn't work the first time and what I changed.
→ Why a fully autonomous agent was the wrong starting point, and what I built instead
→ The exact LLM prompt structure that kept severity scoring consistent across runs
→ Where human review still has to stay in the loop, and why that's a feature, not a gap
Reconstructing a Timeline from a Corrupted NTFS Image
+
This challenge provided a partially corrupted disk image and asked for the exact sequence of attacker actions. The MFT was damaged in several sectors, which ruled out a straightforward timeline tool run.
1. Carved $LogFile entries manually to recover transaction records the MFT had lost
2. Cross-referenced USN Journal entries to fill in gaps around the corrupted timestamps
3. Identified a renamed PowerShell binary used to evade basic filename-based detection
4. Flag recovered by correlating shellbag artifacts with the reconstructed access pattern
MFTECmdNTFS ForensicsAutopsy
Web ExploitationHackTheBox· Medium Difficulty
Chaining an IDOR with a JWT Algorithm Confusion Bug
+
A REST API exposed user records via sequential numeric IDs (classic IDOR), but read-only data wasn't enough for full compromise, privilege escalation needed a second bug.
1. Enumerated user IDs via the IDOR to harvest a victim's public key reference
2. Server accepted both RS256 and HS256, switched algorithm and signed with the public key as an HMAC secret
3. Forged an admin-scoped JWT, bypassing signature verification entirely
4. Root cause: library accepted the "alg" header from the client instead of enforcing server-side config
Burp SuiteJWT.ioPython
OSINTHoLmes CTF 2025· Hard Difficulty
Tracking a Threat Actor Through Reused Infrastructure Metadata
+
Given only a single malicious domain, the challenge asked for the actor's other active infrastructure, a real-world attribution exercise rather than a typical flag hunt.
1. Pivoted from the seed domain's SSL certificate fingerprint to find 6 related domains
2. Passive DNS history revealed a shared hosting IP reused across all identified domains
3. Favicon hash matched a known phishing kit, confirming the campaign's tooling
4. Flag was the registrant email exposed in an early, unprotected WHOIS snapshot
crt.shShodanVirusTotal
Guest Lecture2023· Parul University
Cybersecurity Careers & SOC Operations — BSc Students
+
Invited guest lecture covering real-world cybersecurity career paths, SOC operations, and how to bridge the gap between academic learning and industry expectations — delivered to BSc students at Parul University, Vadodara.
SOC OperationsCareer GuidanceBlue Team
Upcoming2026–27· CFP Preparing
Conference Talk — AI-Augmented SOC Operations
+
Preparing CFP submissions for NULLCON, c0c0n, ClubHack, BSides India, BlackHat Asia, and Hackers Meetup. Talk proposal covers AI-augmented detection engineering with real production examples.
BSidesBlackHatNULLCONHackers Meetupc0c0n
Live Intelligence
AI-Powered Threat Trend Tracker
Weekly-updated cybersecurity trends, CVEs, and threat intel — summarized by AI. This site is a living resource, not a static CV.
Multiple high-severity vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog — affecting enterprise VPN solutions and email gateways. Immediate patching advised.
CISA KEVVPNPatch Now
🟠 Threat ActorAug 2026
AI-Assisted Phishing Campaigns Surge 340%
Threat actors using LLMs to generate contextually relevant, grammatically perfect spear-phishing emails. Traditional signature-based detection failing at 78% rate. Behavioral AI analysis required.
AI ThreatsPhishingLLM Abuse
🔵 Detection TipAug 2026
MITRE ATT&CK v16 — New Techniques Added
MITRE ATT&CK v16 released with 12 new techniques covering AI system attacks, deepfake-assisted social engineering, and post-quantum cryptography bypass attempts.
MITRE ATT&CKv16Update
🟠 IndustryAug 2026
Ransomware Groups Targeting APAC Supply Chains
Multiple ransomware groups shifting focus to APAC technology supply chains — particularly targeting Indian IT service companies and their downstream clients. EDR coverage critical.
RansomwareAPACSupply Chain
🔵 Tool UpdateJul 2026
Wazuh 4.9 — AI-Native Anomaly Detection
Wazuh 4.9 ships with native ML-based anomaly detection, reducing false positive rates by up to 40% on noisy log sources. New integration with Microsoft Sentinel via native connector.
WazuhMLSentinel
🔴 Zero DayJul 2026
Prompt Injection in Enterprise AI Copilots
Multiple prompt injection vulnerabilities discovered in enterprise AI copilots deployed in SOC environments — attackers embedding malicious instructions in log data to manipulate AI triage decisions.
Prompt InjectionAI SecuritySOC Risk
Free Resources
Resources & Extras
A weekly briefing and a couple of interactive ways to test yourself, built for anyone curious about cybersecurity, not just recruiters.
💡 Security Tip of the Day
🛡️
Loading today's tip...
📬
Weekly Threat Briefing
5 bullet points every week, the CVEs that mattered, one tool worth knowing, and one thing I learned in the SOC. No spam, unsubscribe anytime.
🎯 Can You Spot the Phishing Email?
Question 1 of 5
Growth Mindset
Roadmap & Future Direction
M.S. Cybersecurity is complete. Here are the six directions I'm actively evaluating and building toward next, each with real progress already underway.
✓ COMPLETED
🎓
M.S. Cybersecurity
Completed 2024 to 2026 alongside full-time SOC work. Capstone project: CyberShield AI, an AI-based phishing URL detection and malware scanner with LLM-generated threat reports.
Degree Progress100%
PostgraduateAI Capstone
● ACTIVE
🤖
AI Security / AI-Augmented Defense
Prompt injection defense, LLM security, AI-driven SOC automation, and adversarial ML. The direction I'm most actively building toward right now, given how much of my daily work already runs through AI tooling.
Progress40%
AI SecurityAgentic Workflows
● ACTIVE
🎯
Offensive Security / Red Team
OSCP path, advanced VAPT methodology, and red team operations. Sharpening offensive skills directly strengthens how I think about defense.
Study Progress35%
OSCPRed Team
NEXT
☁️
Cloud Security Architecture
Multi-cloud security across AWS, Azure, and GCP, Zero Trust design, container and Kubernetes security, and cloud-native SIEM at an architect level.
Progress20%
AWSZero Trust
NEXT
🔍
DFIR Specialist
Advanced digital forensics certifications, malware reverse engineering, and deeper incident response specialization beyond current SOC-level DFIR work.
Progress15%
ForensicsMalware RE
PLANNED
📋
GRC & Compliance Leadership
ISO 27001 Lead Implementer, broader risk management frameworks, audit leadership, and a path toward virtual CISO advisory work.
Progress10%
ISO 27001vCISO
PLANNED
👔
Security Leadership / CISO Track
Security program management, board-level reporting, team leadership, and budget ownership, the long-term direction once the technical foundation across the other tracks is solid.
Progress5%
Leadership2027+ Goal
Writing & Research
● Medium Active
Articles, Blogs & Research
Long-form technical deep-dives on Medium, LinkedIn thought-leadership posts, and original security research. Follow along as I document real-world SOC engineering, detection logic, and AI-augmented security operations.
Building an Agentic SOC: What n8n Automation Actually Looks Like in Production
A real walkthrough of the n8n agent pipelines I run for alert enrichment and triage — including the parts that didn't work the first time and what I changed. Covers LLM prompt structure, where human review stays in the loop, and what agentic actually means in a production SOC.
Ⓜ Medium
Detection EngineeringAug 2026· 10 min read
Detection-as-Code: Writing Sigma Rules That Actually Work Across 6 SIEMs
Walk-through of my Detection-as-Code repo — how one Sigma rule translates to native queries for Splunk, Elastic, Sentinel, Defender, CrowdStrike, and QRadar, with all the edge cases that break vendor-specific syntax.
Ⓜ Medium
Purple TeamAug 2026· 8 min read
Purple Team Validation: Does Your Detection Rule Actually Catch the Attack?
Most teams write detection rules and assume they work. This article walks through using Purple-team-validator to test Sigma rules against real Atomic Red Team tests — and the uncomfortable results when rules that "should" fire, don't.
in LinkedIn
SOC OperationsJan 2025· 8 min read
Zero Trust Architecture in Modern SOC Operations
After implementing Zero Trust principles at Investis Digital — APT dwell time dropped 68%, MFA + behavioral analytics reduced credential attacks by 73%, and MTTD went from 4 hours to 18 minutes using Wazuh ML rules.
in LinkedIn
Threat HuntingNov 2024· 12 min read
The Art of Proactive Threat Hunting: From Reactive SOC to AI-Augmented Hunter
Documenting my shift from reactive alert-handling to proactive threat hunting using AI-generated hypotheses. Includes two real production discoveries — a DGA pattern in DNS and an exposed S3 bucket — caught before any alert fired.
in LinkedIn
Cloud SecuritySep 2024· 10 min read
Cloud Security Blind Spots: 5 AWS Misconfigurations That Led to Real Breaches
After analysing 200+ cloud security incidents — most weren't zero-days, they were misconfigs that existed for months. Five recurring patterns, what they led to, and the automated remediations that work.
in LinkedIn
AI & SecurityApr 2025· 9 min read
What Actually Changes When You Put an LLM Inside a SOC Workflow
There's a lot of hype and very little specificity about AI in security operations. Report drafting time dropped 70%, but the real win was agentic automation chaining tool calls — not chat-based Q&A.
in LinkedIn
GRCFeb 2025· 7 min read
ISO 27001:2022 in Practice: What the Audit Doesn't Tell You
Documented controls and operationally enforced controls are not the same thing — a lesson from supporting a full ISO 27001 audit cycle. The teams treating GRC as a living process, not an annual event, audited the smoothest.
📝 Coming to Medium
ResearchIn Progress
MITRE ATLAS in Real AI-Powered SOC Environments
Documenting findings from the Atlas-purple-team project — how MITRE ATLAS techniques map to actual AI-SOC tooling, what the live dashboard revealed, and what defenders should watch for.
Ⓜ
Follow on Medium
New articles on detection engineering, AI-augmented SOC operations, and real-world security research — published regularly.
Sharing what I know — at meetups, webinars, college sessions, and online communities. Security knowledge compounds when it's passed forward. This section grows as I speak and engage more publicly.
3+
Talks & Sessions
2
Guest Lectures
7K+
LinkedIn Followers
3
Domains Covered
🎙️ Webinar
AI-Augmented SOC: Practical LLM Use Cases for Blue Teams
Covered real-world LLM integrations in SOC workflows — from alert triage and report drafting to agentic n8n pipelines. Walked through prompt engineering pitfalls and where human review cannot be removed.
AI & SOCDetection Engineering
🎓 Guest Lecture
Breaking Into Cybersecurity: The Real Path From Student to SOC Analyst
Guest lecture delivered to undergraduate cybersecurity students — covered the actual difference between certification paths and hands-on lab work, what real hiring managers look at, and how to build a portfolio that proves skill not just credentials.
Career DevelopmentSOC Fundamentals
💬 Community Talk
Open-Source SOC Stack: Building a Full Detection Lab for Under ₹0
Walked a community group through the SOC-Lab-Open-Source-Setup repo — Wazuh, Suricata, Kibana, TheHive, and MISP on a single VM. Covered architecture decisions, what each tool covers, and the gaps every free stack has.
Open SourceSOC Lab
📩 Invite Me
Invite Me to Speak
Available for webinars, university guest lectures, security meetups, podcast appearances, and panel discussions on: SOC engineering, AI in security, detection-as-code, open-source security tooling, and breaking into cybersecurity.
SOC EngineeringAI SecurityCareer Advice
🌐 Community Presence
in
LinkedIn
7,000+ followers · Regular SOC & AI security posts
Long-form technical writing on SOC engineering, AI in security, detection-as-code, and real incident retrospectives. Published on Medium — where the detail level that LinkedIn can't hold goes.
AG
@akgoswami185
SOC Engineer · Detection Engineering · AI in Cybersecurity
Detection-as-Code: Writing Sigma Rules That Actually Work in Production
📅 July 2026 · Medium
Scheduled →
AI SecuritySOC Ops
Coming Soon
What Actually Changes When You Put an LLM Inside a SOC Workflow
📅 August 2026 · Medium
Scheduled →
AI SecurityPurple Team
Coming Soon
MITRE ATLAS vs Your SOC: Testing AI Attack Techniques Against Real Defenses
📅 September 2026 · Medium
Scheduled →
CloudDetection Eng.
Coming Soon
Microsoft Sentinel from Scratch: Building Detection Rules That Ship to Production
📅 October 2026 · Medium
Scheduled →
GRCCompliance
Coming Soon
GRC Isn't Just Documentation: Building a Live Compliance Platform on GitHub
📅 November 2026 · Medium
Scheduled →
CareerSOC Ops
Coming Soon
From Gold Medallist to SOC Engineer: What 2 Years in Blue Team Actually Taught Me
📅 December 2026 · Medium
Scheduled →
Thought Leadership
Speaking & Community
Sharing real-world SOC engineering experience with the cybersecurity community — through conference talks, webinars, workshops, and mentorship. Available for speaking engagements on AI-augmented detection, blue team operations, and building modern SOC tooling.
How LLMs, agentic automation, and ML anomaly detection are changing the economics of threat detection — with real production examples, not demos.
⏱ 30–45 min · Intermediate
🛡️
Detection Engineering at Scale
Writing Sigma rules that actually work in production, multi-vendor detection-as-code pipelines, and validating coverage with purple team automation.
⏱ 45–60 min · Intermediate–Advanced
🎯
MITRE ATT&CK in Real SOC Workflows
Moving beyond the matrix to actual detection coverage mapping, threat-informed defense, and hunting hypotheses grounded in real attack chains.
⏱ 30–45 min · All Levels
📋
GRC Without the Checkbox Mindset
Building compliance automation that monitors live control drift rather than annual audit prep — ISO 27001, NIST, and PCI-DSS crosswalk as code.
⏱ 30 min · Beginner–Intermediate
🔴
Purple Team Validation for Blue Teamers
How to verify that your detection rules actually fire against real adversary techniques — using Atomic Red Team, Sigma validation, and MITRE ATLAS for AI systems.
⏱ 45 min · Intermediate
☁️
Cloud Security for SOC Engineers
AWS and Azure misconfigurations that lead to real breaches, Sentinel detection-as-code, and building cloud-native SOC tooling on Microsoft's security stack.
⏱ 45–60 min · Intermediate
Speaking History & Upcoming
Upcoming
2026–27
Open to Conference Talks & Meetups
Targeting NULLCON · c0c0n · ClubHack · BSides India · BlackHat Asia · Hackers Meetup · Virtual or In-Person
Actively preparing CFP submissions for major Indian and global cybersecurity conferences. Talk topics are ready — reaching out to event organizers. Open to both online and in-person engagements.
Invited guest lecture for BSc students at Parul University covering real-world cybersecurity career paths, SOC operations, and practical skills that bridge the gap between academic learning and industry expectations.
Mentoring friends, colleagues, and junior cybersecurity professionals across certification prep, SOC tooling, career direction, resume reviews, and mock interviews. Helping the next generation navigate into the industry the way I wished someone had helped me.
Available for conferences, corporate security workshops, university sessions, and podcast interviews. Travel within India and virtual engagements globally.
Starting with my own published tools — 21 public repositories. External contributions to community projects are a goal for 2026–27.
🐙
Aditya-Sec / GitHub
github.com/Aditya-Sec · 21 Public Repositories · MIT License
Author of 21 open-source cybersecurity repositories. All are MIT licensed and publicly available on GitHub. External open-source contributions are just beginning — starting with SOC tooling in the community.
→ Contribute detection rules to Elastic Detection Rules
→ Open PRs to TheHive-Project and MISP
New Track · Starting August 2026
Research: AI × Cybersecurity
A dedicated research initiative at the intersection of Artificial Intelligence and Cybersecurity — covering AI-native attack techniques, LLM security, agentic SOC systems, adversarial ML, and the evolving threat landscape. Published on Medium and shared with the community.
🧠
● Active
LLM Security & Prompt Injection in Enterprise AI
Investigating OWASP LLM Top 10 vulnerabilities in enterprise AI copilots deployed in SOC environments. Focus: how attackers embed malicious instructions in log data to manipulate AI triage decisions. Testing mitigations against real prompt injection techniques.
→ Can an attacker control AI SOC triage via crafted log payloads?
→ What defensive prompt engineering patterns are effective at scale?
OWASP LLMPrompt InjectionAI SOCClaude API
⚔️
○ Planned
AI-Generated Phishing: Detection vs. Evasion Arms Race
Analyzing how LLM-generated spear phishing emails evade traditional NLP-based email security tools. Building a detection dataset of AI-generated vs. human-written phishing samples to test classifier robustness.
→ Can current email security ML models detect GPT-4o generated phishing?
→ What features reliably distinguish AI-generated vs. human phishing?
Adversarial MLPhishing DetectionNLPEmail Security
🤖
○ Planned
Agentic AI SOC: Autonomous Triage and Response
Exploring multi-agent architectures for SOC automation — from alert enrichment agents to autonomous IR decision agents. Evaluating where human oversight is essential vs. where full autonomy is safe and beneficial.
→ What SOC decisions can be safely automated vs. need human judgment?
→ How do we implement reliable human-in-the-loop for high-stakes IR actions?
Agentic AIMulti-AgentSOC AutomationHuman-in-Loop
🔐
○ Planned
MITRE ATLAS: AI Attack Technique Mapping for Defenders
Practical mapping of MITRE ATLAS techniques to defensive countermeasures for organizations deploying AI systems. Building on Atlas-purple-team repo work — creating a defender-centric playbook for AI system protection.
→ Which ATLAS techniques have no current defensive coverage?
→ How should SOC playbooks adapt for AI system attack scenarios?
MITRE ATLASAI DefensePlaybooksPurple Team
📰 Publication Track
All research findings will be published on Medium (@akgoswami185) and shared as open-source datasets and tooling on GitHub. Community feedback and collaboration welcome.
Detailed post-incident analysis of real security events — some anonymized from SOC experience, some from major public breaches reconstructed from verified reports. Every timeline, finding, and lesson here is grounded in actual events.
🔴 Critical — Internet-Scale Outage
Cloudflare · June 2023 · BGP Misconfiguration
Scenario Overview
On June 27, 2023, Cloudflare experienced a significant outage affecting numerous services globally. The root cause was a BGP routing change made during a network infrastructure update that inadvertently withdrew routes, causing Cloudflare's edge network to become unreachable from large portions of the internet. Services including Cloudflare DNS (1.1.1.1), Zero Trust, and Cloudflare Workers were affected for approximately 37 minutes.
Immediate Triage — Distinguish Attack from Operational Error
First 3 minutes: check for concurrent DDoS telemetry (Suricata, Cloudflare WAF), validate upstream BGP peer status across multiple IXPs, cross-check with change management tickets. The presence of a simultaneous internal change request would shift classification from "attack" to "operational incident" immediately.
02
Detection Gap — Change-Correlated Outage
A mature SOC would have a CI/CD-to-SIEM integration: any network change ticket automatically creates a monitoring window with elevated sensitivity. This outage had a 2-minute gap between the change and the first alert — with integration, that closes to near-zero.
03
Lesson for Detection Engineering
BGP route withdrawal is a detectable event. A Sigma rule watching for simultaneous loss of reachability across multiple anycast nodes with no external DDoS correlation is a valid detection primitive that most enterprise SOCs don't have written.
Relevant MITRE:T1498 — Network DoST1565 — Data ManipulationOperational Error — Not ATT&CK
🔴 Critical — Largest IT Outage in History
CrowdStrike Falcon · July 19, 2024 · Faulty Content Update
Scenario Overview
On July 19, 2024, CrowdStrike deployed a Falcon sensor content update (channel file 291) containing a logic error that caused Windows systems running Falcon to kernel panic (BSOD) on boot. The update propagated to approximately 8.5 million Windows endpoints globally in under 90 minutes, affecting airlines, hospitals, banks, broadcasters, and emergency services. Recovery required manual physical access to each affected machine — a BitLocker key and safe-mode boot to delete the faulty file. The estimated economic damage exceeded $10 billion.
Incident Timeline
04:09 UTC
Channel file 291 pushed globally to all Falcon sensors — update contains null pointer dereference
04:11 UTC
First BSOD reports appear on internal monitoring — initially dismissed as isolated
04:27 UTC
Mass BSOD reports flood in globally — CrowdStrike declares critical incident
04:29 UTC
Update reverted — but 8.5M endpoints already affected and cannot receive the fix at boot
05:00+ UTC
Manual remediation begins worldwide — days-long recovery process
SOC Analysis & Lessons
01
Staged Rollout — The Missing Safeguard
The update went to all endpoints simultaneously with no canary deployment. A phased rollout (1% → 5% → 25% → global) with automated BSOD rate monitoring at each stage would have stopped this at 1% penetration — affecting ~85,000 endpoints instead of 8.5 million.
02
Detection: Mass BSOD is a Detection Rule
A Wazuh/Sentinel alert firing on >50 Windows kernel crash events across an estate in under 5 minutes with a common driver/update correlation would have flagged this as a supply chain event — even if the vendor didn't. Enterprise SOCs should have this detection.
03
Business Continuity Planning — The Real Gap
The multi-day recovery proved most organizations had no tested procedure for "EDR kills all Windows endpoints simultaneously." BCP drills should include this scenario. Physical access + BitLocker key management procedures should be documented and accessible offline.
Enterprise · 2024 · Credential Stuffing via Rotating Proxy Infrastructure
Scenario Overview
An anonymized credential-stuffing campaign against an enterprise web application, detected during active SOC monitoring. The attacker used a distributed proxy network across 6 countries with request rates carefully tuned below WAF thresholds. Initial detection failed — the campaign was discovered during a routine threat hunt. This scenario directly informed the detection rule improvements documented in the "Mistakes" section.
Existing detection rule misses attack — rule requires 5 failures from single IP within 5 minutes. Distributed pattern evades this entirely.
Day 6
Routine threat hunt cross-correlates ALB logs with authentication events. Pattern identified: 847 unique IPs targeting /api/login, all with near-identical User-Agent strings.
Day 6 + 2h
Cloudflare WAF rule deployed: block IPs with >2 failed auth attempts per 24h across any session. Attack blocked.
Accounts force-reset. MFA enforcement accelerated. New detection rule deployed to SIEM.
Detection Engineering Response
01
New Sigma Rule: Distributed Credential Stuffing
Detection logic shifted from per-IP rate to aggregate endpoint failure rate: >200 unique source IPs generating authentication failures against a single endpoint within 1 hour triggers high-severity alert. Covers distributed patterns that single-IP rules miss entirely.
02
User-Agent Clustering as IOC
Credential stuffing tools often produce statistically homogeneous User-Agent distributions. A KQL query clustering Auth failures by User-Agent entropy (low entropy = suspicious) is now part of the standard hunting playbook.
⚠️ This is a hypothetical scenario constructed from real threat patterns documented by CISA, ENISA, and public breach reports. All organizations and individuals are fictitious.
A SaaS provider used by a mid-size enterprise for HR data processing is compromised via a malicious npm package introduced during a dependency update. The attacker uses the vendor's update delivery mechanism as a beachhead to reach downstream enterprise environments — a classic software supply chain attack following the SolarWinds and 3CX pattern.
Attack Timeline
T-30 days
Threat actor compromises vendor CI/CD pipeline via stolen developer credentials. Malicious backdoor inserted into update package — passes existing code review due to obfuscation.
T-0
Vendor pushes update to 2,000 enterprise clients. Malicious code establishes encrypted C2 channel via DNS over HTTPS (DoH) — evades standard DNS monitoring.
T+3 days
CISA advisory published — enterprise SOC correlates the IoCs against their environment. C2 traffic identified in Zeek/Suricata logs via JA3 fingerprint matching.
T+3 + 4h
Vendor application isolated. Network segmentation prevents lateral movement. Threat hunt reveals no data exfiltration in the 3-day window.
Containment complete. Vendor application rebuilt from verified source. SBOM review initiated for all remaining SaaS dependencies.
Key Lessons for Enterprise SOC
01
Vendor Risk = Attack Surface
Every SaaS tool in an enterprise environment is a potential supply chain vector. SBOM (Software Bill of Materials) tracking for critical vendors, combined with CISA KEV monitoring for vendor-specific CVEs, should be a standard SOC responsibility — not just a procurement checklist item.
02
DoH as a C2 Evasion Technique
DNS over HTTPS tunneling bypasses traditional DNS monitoring. Detection requires JA3/JA3S fingerprinting in Suricata or Zeek, combined with flow volume analysis on known DoH provider IPs (8.8.8.8, 1.1.1.1 over 443) at anomalous volumes.
Endorsements from managers and peers, the human side of the résumé.
"
★★★★★
Aditya consistently goes beyond alert triage. His ability to correlate weak signals across multiple data sources, and communicate findings clearly to non-technical stakeholders, is rare at his experience level. He's the kind of analyst every SOC team needs.
SM
Senior Manager, SOC
Investis Digital Pvt Ltd
"
★★★★★
What sets Aditya apart is how he applies AI tools practically in SOC workflows. He built automation scripts that saved our team hours weekly and wrote detection rules that reduced our false positive rate significantly. A proactive, self-driven professional.
TL
Team Lead, Security Engineering
Investis Digital Pvt Ltd
"
★★★★★
During his internship, Aditya demonstrated exceptional understanding of forensic analysis workflows. His CGPA and Gold Medal reflect genuine aptitude, he combines academic rigor with hands-on practicality, which is uncommon in early-career professionals.
PS
Forensics Supervisor
Regional Forensic Science Lab
"
★★★★★
I've worked shoulder to shoulder with Aditya on live incidents, and what stands out is how calm he stays under pressure. He doesn't just close tickets, he actually understands the why behind an attack chain before writing it up. That's a rarer skill than people think.
SE
SOC Engineer, Colleague
Investis Digital Pvt Ltd
"
★★★★★
Aditya is one of the few people on our team who actually documents things well enough that someone else could pick up his work mid-incident without missing context. That habit alone has saved us real time during shift handovers.
SO
Security Operations Specialist
Investis Digital Pvt Ltd
"
★★★★★
What impressed me about Aditya during our engagement was how quickly he picked up context on a client's environment and started flagging real risk, not just textbook findings. He brings genuine curiosity to offensive work, which is exactly what good VAPT needs.
CO
Co-Founder
Cyber Octet Private Limited
"
★★★★★
Aditya has the rare combination of technical depth and genuine willingness to mentor others coming up in the field. The certifications are impressive on paper, but what actually matters is that he can explain complex security concepts simply, that's a leadership trait, not just a technical one.
FO
Founder
Sannibh Technologies
📍 Where Visitors Are Coming From
Real, anonymized traffic sources, refreshed each time this page loads. No fabricated logos, just honest numbers.
Direct
Your Source
Detecting...
Device Type
Counting...
Your Visit #
Contact
Let's Connect
Looking to hire, collaborate, or discuss cybersecurity and AI? I'd love to hear from you.
