I lead Security Operations with a focus on building resilient detection capabilities, streamlining incident response, and automating repetitive analyst work so teams can focus on what matters — finding and stopping threats.

• Security Operations Leadership — Managing SOC teams, shift coverage, SLA governance, and analyst development
• Detection Engineering — Writing and tuning detection rules (Sigma, KQL, SPL) mapped to MITRE ATT&CK
• Incident Response — Owning IR playbooks from phishing to ransomware; P1 incident commander
• Security Automation — Building Python tools for alert triage, IOC enrichment, and automated reporting
• Compliance & Reporting — NIST CSF, ISO 27001; producing board-level executive summaries and CISO dashboards

Repository	Description	CI
🚨 soc-incident-response	IR playbooks, runbooks, and incident report templates — from phishing to ransomware
🔍 soc-detection-rules	Sigma detection rules and threat hunting queries mapped to MITRE ATT&CK
⚙️ soc-automation	Python scripts for IOC enrichment, automated alert triage, and severity classification
📊 soc-compliance-reporting	NIST CSF audit checklists, SOC KPI metrics, weekly/monthly executive report templates
🌐 soc-threat-intelligence	IOC feeds, actor profiles, TI reports, and MISP integration guides
🛡️ soc-vulnerability-management	Vulnerability workflows, patch SLA tracking, CVSS risk scoring, and remediation processes
🎓 soc-training-lab	Analyst onboarding, training scenarios, tabletop exercises, and certification roadmap

SIEM / Detection  

Languages & Scripting  

Frameworks & Standards  

DevOps & Automation  

"A SOC that can't measure itself, can't improve itself."

I believe in three pillars for effective security operations:

1. Detect more, alert less — High-fidelity detections beat alert fatigue every time. Tune ruthlessly.
2. Automate the repeatable — Every manual task a machine can do is analyst time freed for real hunting.
3. Communicate clearly — A P1 incident handled perfectly but reported poorly loses stakeholder trust. Clear, timely communication is a core SOC skill.

All my SOC repos follow the same principles:

• ✅ Version-controlled — Every playbook, rule, and script change is tracked in Git
• ✅ CI/CD validated — GitHub Actions check structure, syntax, and links on every push
• ✅ Framework-mapped — Detection rules and playbooks are tagged to MITRE ATT&CK tactics
• ✅ Tool-agnostic where possible — Sigma rules convert to Splunk SPL, Microsoft KQL, Elastic EQL
• ✅ Peer-reviewed — All production changes go through PR review

• GitHub: @reninjk

"Security is not a product, but a process." — Bruce Schneier