SOC Automation & Threat Intelligence Platform

Integrated 14 security data sources (firewall, EDR, cloud trail, identity, network) into a unified SIEM enrichment pipeline.

Built an ML-based alert triage model trained on 18 months of analyst-labelled alerts, achieving 65% false positive reduction.

Developed an automated threat intelligence enrichment layer that cross-references every alert against 6 threat intel feeds in real-time.

Created a case management interface with automated playbook execution for common incident types (phishing, credential stuffing, data exfiltration).

Delivered a SOC metrics dashboard showing MTTD, MTTR, alert volume trends, and analyst workload distribution.