SOC online · triage automated

HarshaVardhan Aakanti.
I build the machinery that lets a lean SOC scale.

Information Security Analyst working at the meeting point of detection engineering, SOAR automation and enterprise AI. Alerts come in noisy; they leave enriched, triaged and owned end to end.

Connect on LinkedIn Explore writing

Or jump to skills · case files

35%less false-positive noise from tuned custom detections
12+SOAR playbooks shipped in Tines and Python
15m→30sfirst-pass L1 triage with AI-assisted enrichment
6+ yrsacross enterprise SOC and offensive security
Profile

Defender with an attacker's background

Three and a half years inside a global enterprise SOC at a cloud-security company, preceded by three years hunting web vulnerabilities on public and private bug bounty programs.

That mix shapes how I work. I read alerts the way an intruder would read a target, and I automate the parts of the job that should never need a human: enrichment, reputation lookups, asset context, ticket drafting. Analysts then spend their time on the decisions that matter. I own incidents from the first alert to the final forensic report, and I lead the training for each year's SOC intern cohort.

Current role
Information Security Analyst 2
Team
Global Information Security · Netskope
Specialty
SOC automation & detection
Background
Bug bounty · Bugcrowd
Education
M.Sc. Cyber Security · NFSU
Languages
English · Hindi · Telugu
How I work

The alert pipeline I engineer

INGEST

Correlate telemetry

Multi-source events land in SIEM and EDR and are correlated into a single story.

Sumo Logic · CrowdStrike · Netskope
DETECT

Tuned detections

Custom rules and signatures written and tuned until the noise drops away.

Detection-as-code · Event Streams
ENRICH

AI first pass

LLMs pull reputation, asset context and history through MCP before a human looks.

Bedrock · Vertex AI · Rovo · MCP
RESPOND

SOAR playbooks

Containment, IOC hunts and ticketing run as rate-limit-aware workflows.

Tines · Python · Graph API
REPORT

Forensic close-out

Timeline, attribution and lessons learned go into a report the business can act on.

Jira · Jira Assets · RTR

Result on the floor: first-pass triage cut from ~15 minutes of tab-switching to a ~30-second context review.

Capability matrix

Skills and toolkit

SIEM & Detection

SK-01
  • Sumo Logic Cloud SIEM
  • Netskope
  • Detection engineering
  • Alert tuning
  • Threat hunting

SOAR & Automation

SK-02
  • Tines
  • Python
  • Bash
  • FastAPI
  • REST APIs
  • Microsoft Graph
  • Jira Assets (CMDB)

AI for Security

SK-03
  • AWS Bedrock
  • Google Vertex AI
  • Atlassian Rovo
  • Model Context Protocol
  • LLM triage

EDR & Endpoint

SK-04
  • CrowdStrike Falcon
  • Real Time Response
  • Event Streams API
  • Automox
  • Microsoft Intune

Incident Response

SK-05
  • Insider threat
  • Phishing & BEC
  • SPF / DKIM / DMARC
  • AWS CloudTrail forensics
  • Session hijack detection

Threat Intel & Offense

SK-06
  • VirusTotal
  • Censys
  • urlscan.io
  • Hybrid Analysis
  • Web app pentesting
  • Reverse engineering
Case files

Investigations, sanitised

HIGHCASE · INSIDER THREAT

Departing-employee data exfiltration

Traced company data moving to personal cloud storage before an exit. Delivered a forensic report with IP attribution, timeline correlation and impossible-travel analysis.

T1567 · Exfiltration over web service

HIGHCASE · CLOUD

LLMjacking reconnaissance on AWS

Root-account activity in CloudTrail showed Bedrock quota enumeration, CloudShell use and no MFA: the early pattern of attackers hunting for model access to resell.

T1078.004 · Valid cloud accounts

MEDCASE · EMAIL

Lookalike-domain mail collection

Phishing and BEC triage through SPF, DKIM, DMARC and multi-hop header forensics uncovered lookalike-domain infrastructure configured to harvest mail.

T1583.001 · Acquire domains

DETECTBUILD · ENDPOINT

Removable-media detection

USB and removable-media detection on the CrowdStrike Event Streams API, with automatic Jira tickets and threat-hunting playbooks behind it.

T1052 · Exfiltration over physical medium

Engineering

Things I have built

Automated threat-hunting pipeline

Tines workflows joining SIEM, EDR, VirusTotal, Jira and Graph API, with IOC enrichment and API rate-limit handling built in.

Tines · Sumo Logic · CrowdStrike · VirusTotal

Falcon RTR control plane

A web tool for remote script execution and sensor lifecycle management across Windows, macOS and Linux endpoints.

Python · FastAPI · React · Falcon RTR

macOS posture audit

A fleet-wide security posture check pushed through endpoint management, with results pulled by API into automated reporting.

Automox · Intune · Tines

AI-assisted L1 triage

LLMs connected to security tooling through MCP servers so every alert arrives pre-enriched with a draft investigation.

Bedrock · Vertex AI · Rovo · MCP

Malware & URL analysis bot

A Telegram bot that scans files and links on demand and returns reputation verdicts in chat.

Python · VirusTotal API · urlscan.io API

Research publication

Paper on a machine-learning search engine, published in IJAEMA in 2021.

Machine learning · Information retrieval

Journey

From breaking in to defending

  1. Information Security Analyst 2

    Netskope · Global Information Security

    Leading SOC modernisation with LLM-driven enrichment, SOAR engineering and endpoint automation.

  2. Information Security Analyst

    Netskope

    Tier-1 and Tier-2 escalations, insider-threat and cloud forensics, detection authoring and hunting playbooks.

  3. Information Security Intern

    Netskope

    Rotated through every team reporting to the CISO: SOC, Threat & Vulnerability Management, AppSec, Security Architecture and PSIRT.

  4. Bug Bounty Hunter

    Bugcrowd · Freelance

    Found and responsibly disclosed web application vulnerabilities across public and private programs.

  5. Security internships

    Pentesting · Cyber investigation · Security analysis

    Early hands-on work in penetration testing, cyber investigation research and security analysis.

Field notes

Positions I argue for

AI will not replace L1 analysts. Analysts who use it will outpace those who don't.

Automation should strip out the boilerplate of stitching telemetry and drafting tickets, so people spend their energy on real hunting and avoid burnout.

MFA protects the login. Attackers now skip the login.

Info-stealers lift session cookies and tokens. The answer is short sessions, token binding, session-reuse detection and revoking sessions during response.

Credentials

Education, training and community

Education
  • M.Sc. Cyber Security, National Forensic Sciences University
  • B.Tech, Computer Science and Engineering
Certifications
  • Mastering Reverse Engineering, Nullcon (2026)
  • AWS Control Tower (2025)
  • AWS Security Hub (2025)
Community
  • Lead instructor for annual SOC intern cohorts
  • Industry session for cyber-security students at NFSU
  • Featured in a documentary on India's next generation of cyber defenders
  • BSides Bangalore 2024