Most SOC dashboards are built to look busy, not to catch anything. I care more about the ten log lines that actually mattered than the thousand that didn't.
Associate SOC Engineer at Investis Digital, Vadodara, India. I work in the space between an alert firing and someone actually understanding what happened — triage, correlation, and AI-augmented detection that turns raw noise into a decision someone can act on.
| 10K+ | 18 min | 30% | 5× |
|---|---|---|---|
| Alerts triaged | Mean time to detect (down from 4 hrs) | False positives cut via ML tuning | Faster detection rule development |
| 9.47 | 40+ | Top 1% | 8+ |
|---|---|---|---|
| CGPA — Gold Medal, Cyber Forensics | Verified certifications | TryHackMe global ranking | HackTheBox machines pwned |
Every number above is drawn directly from real SOC work at Investis Digital and independently verifiable certifications — nothing here is aspirational.
| # | Project | What it answers |
|---|---|---|
| 01 | MSE-Platform | Can a full Microsoft Zero Trust enterprise architecture — identity to AI ops — be built as real, Bicep-CLI-validated Infrastructure-as-Code instead of a single-tool lab? (Phase 2 of 8 live) |
| 02 | SIEM-Tool-Matrix | Can a real ingest-to-alert pipeline (Sigma + YARA, MITRE ATT&CK/NIST CSF/OWASP LLM coverage) plus honest research on all 24 major SIEM platforms live in one place? |
| 03 | SOAR-Playbook-Matrix | Can a real OASIS CACAO execution engine, an AI playbook generator, and honest research on 18 SOAR platforms be the orchestration half of the SIEM+SOAR story? |
| 04 | Falcon-Platform-Matrix | Can all 15 CrowdStrike Falcon modules — RTR, Spotlight, Identity, Cloud, Fusion SOAR — be shown with real, verified FalconPy SDK code, not just an EDR demo? |
| 05 | Detection-as-Code | Can one Sigma rule generate real, correct native queries for Splunk, Elastic, Sentinel, CrowdStrike, and QRadar at once? |
| 06 | Sentinel-Detection-Response-Pack | Can six ATT&CK-mapped detections, two SOAR playbooks, and a cloud posture check ship as deployable code, not a lab screenshot? |
| 07 | AI-SOC-Copilot | Can an LLM triage alerts safely when the alert data itself is attacker-controlled and adversarial? |
| 08 | CyberShield-AI | Can phishing/malware triage be scored transparently — rule-by-rule — instead of hidden behind a black-box model? |
| 09 | VishGuard | Can social-engineering attacks be caught by their behavioral pattern, regardless of whether the voice behind them is real or deepfaked? |
| 10 | SOC-Lab-Open-Source-Setup | Can a full detection-and-response pipeline be built entirely on open-source tooling, end to end? |
| 11 | ReconVeritas | How much of manual recon can be safely automated into one modular workflow? |
| 12 | SOC-Incident-Case-Study | What does a real incident look like end-to-end — detection, response, and the lesson learned? |
| 13 | RedTeam-WAF-Detection-Bypass-Lab | If I were attacking my own detections, where would they break? |
| 14 | Kibana-SIEM-Dashboard-Demo | What does a correlation rule look like from raw log to dashboard alert? |
| 15 | SOC-Alert-Notifier | Can alert routing be automated without losing the analyst's judgment in the loop? |
| 16 | Wireshark-HTTP-Credential-Capture | What does an attacker actually see on unencrypted traffic — hands-on, not theoretical? |
A shareable snapshot, built for LinkedIn, not a filing cabinet.
