Trilok Sanjeev Kumar Salevendula

Security engineering through telemetry, detection & automation

Cybersecurity Engineer and SOC Analyst with 3+ years of experience across threat detection, SIEM monitoring, incident response, threat hunting, behavioral analytics, and security automation.

I enjoy turning raw telemetry into useful detections: understand attacker behavior, map it to MITRE ATT&CK, validate detections, investigate evidence, and tune noise without losing meaningful coverage.

Core focus: Detection Engineering / SOC Operations / Threat Hunting / Automation

Selected impact

50+ detection rules — MITRE ATT&CK-aligned.
35–40% false positives reduced — through tuning.
500+ / week alerts triaged — high-volume SOC.
100+ incidents handled — 24x7 operations.
>90% detection accuracy — maintained.
30% alert noise reduced — baseline refinement.

Security operations
Detection engineering
Automation

Security operations

Alert triage, telemetry correlation, incident investigation and response documentation.

Detection engineering

MITRE ATT&CK-aligned Sigma rules, behavioral detections and detection tuning.

Automation

Python and PowerShell utilities for alert enrichment, IOC processing and evidence collection.

Security operations
Detection engineering
Automation

Selected security work

Enterprise Threat Detection & SIEM Optimization

Challenge: Improve enterprise detection coverage while reducing recurring alert noise and preserving accuracy.

Explore case study

Coverage: Credential abuse; Privilege escalation; Persistence; Lateral movement; Data exfiltration; DNS / C2 anomalies.
What I did: Designed and deployed 50+ detection rules.

Built behavioral detections for PowerShell, WMI, registry and scheduled-task activity.

Used Windows Event IDs 4625, 4720, 4722, 4738, 4756, 5140 and 5145.

Engineered baselines for unusual outbound connections, DNS tunneling and command-and-control.

Maintained 20+ SIEM dashboards and continuously tuned precision / recall.
Impact: 35–40% false positive reduction — without sacrificing meaningful coverage.

>90% detection accuracy — maintained after tuning.

30% alert noise reduction — via baselines + whitelisting.

SECURE VAULT

Enterprise Security & Threat Detection Lab

An isolated multi-VM security lab built to generate endpoint telemetry, centralize logs, create MITRE ATT&CK-aligned detections, validate activity through controlled simulations, and practice analyst investigation workflows.

Explore case study

Stack: Windows 11 + Linux; Oracle VirtualBox; Microsoft Sysmon; Windows Event Logs; Wazuh + Elastic Stack; Sigma / SIEM rules; Wireshark + Npcap; Python + PowerShell.
Architecture: Windows 11 with Sysmon, Event Logs and Defender FW.

Wazuh to centralize and correlate events.

Elastic for dashboards, search and analytics.

Sigma / SIEM rules and alerting.

SOC investigation covering IOC analysis, ATT&CK mapping, timeline and response actions.

Wireshark / Npcap and Python / PowerShell.
Context: I built an isolated Windows 11 and Linux lab in Oracle VirtualBox. It used host-only segmentation, controlled NAT access and recovery snapshots.
Method: I collected Windows telemetry with Sysmon and Windows Event Logs, configured Windows Defender Firewall, and centralized telemetry with Wazuh and the Elastic Stack.
Validation approach: I used controlled attack simulations, packet analysis and event correlation to test detection behavior and document investigations.
Limitations: This independent lab demonstrates a testing approach; it does not establish production performance or coverage.

SECURE VAULT architecture overview

SECURE VAULT lab workflow — summarized from the résumé; detailed configuration and results are not independently verified.

Conceptual workflow, not a verified integration or network topology.

Lab environment: Windows 11 + Linux; Oracle VirtualBox

Main path

Windows endpoint telemetry
- Windows 11
- Microsoft Sysmon
- Windows Event Logs
Wazuh and Elastic Stack
- Wazuh to centralize and correlate events
- Elastic for dashboards, search and analytics
Detection testing and alert review
- Sigma / SIEM rules and alerting
Investigation notes and response actions
- IOC analysis
- ATT&CK mapping
- Timeline
- Response actions

Supporting input

Controlled simulations and packet analysis → Detection testing and alert review

Detection content and tuning

Detect → Validate → Investigate → Tune

Telemetry: Sysmon, Windows, Network.
Detect: Sigma, Behavioral, Baselines.
Investigate: Enrich, Correlate, ATT&CK.
Tune: Suppress, Refine, Retest.

Detection coverage

Credential access: Brute force / credential abuse.
Execution: Suspicious PowerShell.
Privilege escalation: Abnormal privilege activity.
Persistence: Registry / scheduled tasks.
Lateral movement: Host-to-host behavior.
Command & control: DNS / network anomalies.
Exfiltration: Unusual outbound activity.
Defense evasion: Process tampering.

Investigation and response

From alert to response

Triage — Validate alert + severity.
Enrich — User / host / IOC context.
Correlate — Endpoint + DNS + firewall + proxy.
Scope — Timeline + affected assets + ATT&CK.
Respond — Containment / remediation / tuning.

Operational scale

500+ / week alerts triaged — risk + severity-based prioritization.
100+ incidents handled — 24x7 SOC with SLA compliance.

Investigation sources

Authentication, endpoint, DNS, firewall, proxy, file-share and network telemetry.

Experience

Threat Detection Engineer & SOC Analyst · RevSOC

January 2026 – July 2026
- Built and tuned Sigma and behavioral detections for credential abuse, suspicious PowerShell, anomalous processes, lateral movement, privilege escalation, persistence, and exfiltration.
- Automated rule testing, enrichment, and synthetic attack data with Python and APIs; analyzed live tenant alerts and drove noise suppression.
- Highlights: MITRE T1110.001 / .003 / .004 | Python + APIs | alert tuning
SOC Analyst & Threat Detection Specialist · IBM

March 2021 – May 2024
- Designed 50+ detections, maintained 20+ SIEM dashboards, reduced false positives by 35–40%, triaged 500+ alerts per week, and responded to 100+ incidents.
- Investigations covered credential compromise, ransomware, persistence, reconnaissance, suspicious outbound traffic, and potential data exfiltration.
- Projects: SIEM Optimization | Incident Response & Threat Hunting

Tools in context

Tools are grouped by the job they do

Detection & telemetry: Wazuh, Elastic Stack, Elasticsearch, Sigma, Sysmon, Windows Event Logs.
Investigation: Wireshark, Npcap, IOC Analysis, Packet Analysis, Threat Hunting, Root Cause Analysis.
Automation: Python, PowerShell, SQL, APIs, Git, GitHub.
Systems & frameworks: Windows 11, Linux, Oracle VirtualBox, TCP/IP, DNS / ARP / ICMP, MITRE ATT&CK.

How I work: Observe → Detect → Validate → Investigate → Respond → Tune → Automate.

Education

Master of Science in Cybersecurity

Wright State University · Dayton, Ohio · Graduated August 2026

Let's connect

Building better detections. Investigating the signal. Automating the noise.

Open to cybersecurity engineering, SOC, threat detection, detection engineering, threat hunting, and blue-team opportunities.

Request résumé by email

Opens your email app. You can also copy the email address below.

Email:: triloksalevendula@gmail.com
LinkedIn:: linkedin.com/in/trilok-salevendula-0524b3259