Karthikeyan's CV
Karthikeyan K
Cybersecurity Lead | Google SecOps (Chronicle) | SOC Operations & Incident Response
Profile summary
Accomplished Cybersecurity Lead with over 9 years of progressive experience in security operations, incident response, and threat detection engineering. Managing enterprise client accounts, optimizing detection rules mapped to MITRE ATT&CK frameworks, and handling high-severity incident investigations in cloud environments. Dedicated to maintaining operational excellence and delivering robust security solutions across multidisciplinary platforms.
Career highlights
Security Operations Delivery: Directs delivery operations for Google SecOps across enterprise client accounts, managing ingestion architecture and operational readiness handovers while advising stakeholders on security status.
Detection Engineering and SIEM: Authored and optimized YARA-L and KQL analytics rules mapped to MITRE ATT&CK frameworks, reducing false positive volume and tuning detection rules to improve accuracy.
Incident Response and SOAR: Managed high-severity incident response in AWS environments while developing automated SOAR playbooks, incident response runbooks, and standardized alert triage procedures.
Professional Certifications: Maintains industry credentials including Google Professional Security Operations Engineer and Google Professional Cloud Security Engineer certifications.
Key skills
Professional experience
Directs delivery operations for Google SecOps across enterprise client accounts, managing ingestion architecture and operational readiness handovers. Coordinates detection engineering, log integration, and threat hunting initiatives, while advising CISO stakeholders on security status.
- Authored and optimized YARA-L and KQL analytics rules mapped to MITRE ATT&CK, reducing false positive volume.
- Integrated cloud, identity, endpoint, and network log sources using forwarders and feeds with UDM normalization.
- Managed high-severity incident response in AWS environments, handling full investigation, containment, and remediation.
- Developed SOAR playbooks, incident response runbooks, and standardized alert triage standard operating procedures.
- Guided and mentored SOC analysts on Google SecOps investigation workflow, UDM search, and triage documentation.
Directed regional engineering operations as a contractor, coordinating with multidisciplinary personnel to align daily tasks with facility objectives and project specifications.
- Completed designated engineering deliverables according to project specifications.
- Provided technical support for ongoing site activities and maintenance routines.
Directed security operations for a 24 by 7 SOC environment, managing high-priority incident escalations, tuning detection rules to improve accuracy, and tracking emerging threats and CVEs to update internal detection logic.
- Responded to high-priority incident escalations within SLA timelines while performing detailed analysis.
- Investigated suspicious emails, malicious domains, and IPs using open source intelligence tools to produce actionable indicators of compromise reports.
Projects
Ran the discovery and assessment phase: inventoried existing log sources, detection rules, dashboards, and use cases in the legacy SIEM, then mapped each to a Google SecOps equivalent. Designed the phased migration plan and cutover approach, including a parallel-run period to validate detection parity before the legacy platform was decommissioned. Migrated detection content by re-authoring legacy correlation logic as YARA-L rules, aligning each rule to MITRE ATT&CK techniques and tuning against live telemetry. Re-onboarded log sources through forwarders, feeds, and native cloud ingestion; validated parsing and UDM field mapping so historical search and detections behaved as expected.
Owned the end-to-end build from requirements gathering to go-live: tenant setup, RBAC and access model, ingestion architecture, and data retention planning. Integrated log sources across AWS, Google Cloud, Microsoft 365 / Entra ID, Microsoft Defender for Endpoint, firewalls, DNS, and proxy, building custom parsers for in-house applications and validating UDM normalisation. Deployed a baseline detection pack combining curated detections with custom YARA-L rules, then ran an iterative tuning cycle to reduce noise before handover. Defined operational readiness - alert triage SOPs, escalation matrix, dashboards, and reporting cadence - and transitioned the environment into 24×7 SOC monitoring.
Designed and documented incident response playbooks aligned to the NIST IR lifecycle for phishing, malware, identity compromise, data exposure, and cloud misconfiguration scenarios. Automated repetitive triage steps - IOC enrichment, OSINT lookups, asset and user context retrieval - so analysts could reach a verdict faster and with more consistency. Standardised triage SOPs and runbooks across the SOC, which shortened new analyst onboarding time and improved consistency of investigation quality.
Acted as single point of ownership from client onboarding through steady-state operations: scoping, platform build, detection coverage, monitoring, reporting, and continuous improvement. Built a recurring threat hunting programme using hypothesis-driven hunts across SecOps telemetry, converting successful hunts into permanent YARA-L detections.