I run the SOC day-to-day. My focus is detection engineering, incident response, and building automation that removes grunt work from the analyst queue. The goal is always the same: find real threats faster and cut the noise.
- Security Operations Leadership: Managing SOC teams, shift coverage, SLA governance, and analyst development
- Detection Engineering: Writing and tuning detection rules (Sigma, KQL, SPL) mapped to MITRE ATT&CK
- Incident Response: Running IR playbooks from phishing to ransomware; P1 incident commander
- Security Automation: Building Python tools for alert triage, IOC enrichment, and SOAR integration
- Threat Intelligence: Actor profiling, TI feed management, IOC lifecycle, MISP integration
- Compliance & Reporting: NIST CSF, ISO 27001; board-level executive summaries and CISO dashboards
| Project | Status | Description |
|---|---|---|
| SOAR Webhook Listener | ✅ Complete | FastAPI receiver with auto-triage and IOC enrichment |
| ATT&CK Coverage Expansion | 🔄 In Progress | Growing Sigma rule library across all tactics |
| DNS Beaconing Detection | ✅ Complete | High-fidelity C2 detection via DNS frequency analysis |
| Threat Actor Profiles | 🔄 In Progress | Structured actor profiles with full TTP mapping |
| Quarterly Compliance Reporting | ⏳ Planned | Automated NIST CSF gap analysis + board pack |
| Repository | Description | CI |
|---|---|---|
| 🚨 soc-incident-response | IR playbooks, runbooks, and incident report templates covering phishing through ransomware |  |
| 🔍 soc-detection-rules | Sigma detection rules and threat hunting queries mapped to MITRE ATT&CK |  |
| ⚙️ soc-automation | Python tools for alert triage, IOC enrichment, SOAR webhook integration, and metrics |  |
| 📊 soc-compliance-reporting | NIST CSF audit checklists, SOC KPI metrics, weekly/monthly executive report templates |  |
| 🌐 soc-threat-intelligence | IOC feeds, threat actor profiles with TTP mapping, TI reports, and MISP integration |  |
| 🛡️ soc-vulnerability-management | Vulnerability workflows, patch SLA tracking, CVSS risk scoring, and remediation processes |  |
| 🎓 soc-training-lab | Analyst onboarding, training scenarios, tabletop exercises (ransomware + BEC), cert roadmap |  |
SIEM / Detection 
Languages & Scripting 
Detection Formats 
Frameworks & Standards 
DevOps & Automation 
Current Sigma rule coverage across tactics (soc-detection-rules):
| Tactic | Rules | Key Techniques |
|---|---|---|
| Initial Access | 1 | T1566 Phishing |
| Execution | 1 | T1059 Scripting |
| Persistence | 1 | T1053 Scheduled Task |
| Privilege Escalation | 1 | T1053.005 Scheduled Task |
| Defence Evasion | 1 | T1562 Disable Tools |
| Credential Access | 2 | T1003.001 LSASS, T1110 Brute Force |
| Discovery | 1 | T1082 System Info |
| Lateral Movement | 2 | T1021.001 RDP, T1021.002 SMB |
| Command & Control | 1 | T1071.004 DNS Beaconing |
| Impact | 1 | T1486 Ransomware |
| TOTAL | 12 | Expanding monthly |
"A SOC that can't measure itself, can't improve itself."
I believe in three pillars for effective security operations:
- Detect more, alert less: High-fidelity detections beat alert fatigue every time. Tune ruthlessly.
- Automate the repeatable: Every manual task a machine can do is analyst time freed for real hunting.
- Communicate clearly: A P1 incident handled perfectly but reported poorly loses stakeholder trust.
All my SOC repos follow the same principles:
- ✅ Version-controlled: every playbook, rule, and script change tracked in Git
- ✅ CI/CD validated: GitHub Actions check structure, syntax, and links on every push
- ✅ Framework-mapped: detection rules and playbooks tagged to MITRE ATT&CK tactics
- ✅ Tool-agnostic where possible: Sigma rules convert to Splunk SPL, Microsoft KQL, Elastic EQL
- ✅ Peer-reviewed: all production changes go through PR review
- ✅ OPSEC-first: no real credentials, IOCs, or employer data in any repo
- GitHub: @reninjk
- Open to connecting with fellow SOC practitioners, detection engineers, and IR professionals
"Security is not a product, but a process." - Bruce Schneier