SOC Analyst & Detection Engineer
MCA student and EC-Council Certified SOC Analyst building real-world detection pipelines, triage automation, and incident response playbooks. Open to L1/L2 SOC Analyst roles.
Core Competencies & Credentials
Certified SOC Analyst and MCA student with hands-on lab experience across SIEM correlation, detection engineering, and digital forensics.
SIEM Architecture & Log Correlation
Ingesting and correlating host telemetry, Windows Security Event Logs (EID 1, 3, 10, 4624, 4625), and Linux auditd logs for multi-source triage and alert fidelity.
Detection Engineering & Threat Hunting
Authoring vendor-agnostic Sigma rules mapped to MITRE ATT&CK techniques. Hunting unflagged persistence mechanisms, credential dumping, and lateral movement in enterprise logs.
Incident Triage & Digital Forensics
Rapid host triage, live memory dump analysis, process hollowing detection, network packet inspection, artifact timeline reconstruction, and containment playbooks.
SecOps Automation & Threat Intel
Authoring triage automation scripts, IOC enrichment bots (VirusTotal, AbuseIPDB, Shodan), log normalization parsers, and custom detection test harnesses.
Education & Credentials
Formal university academics, vendor accreditations, and practical blue team lab completions.
Master of Computer Applications (MCA)
Active University Student · Systems & CybersecurityCertified SOC Analyst (CSA)
EC-CouncilIBM Cybersecurity Analyst Certificate
IBM / CourseraSOC Level 1 Track
TryHackMe (Ranked Blue Team)Google Cybersecurity Certificate
Google Career CertificatesCyber Defense & Threat Hunting Labs
Blue Team Labs / LetsDefendLive Global Threat Telemetry
Real-time honeypot correlation & SIEM telemetry simulating adversary TTPs, active C2 beacons, and automated SOC containment actions worldwide.
SOC Labs & Detection Tools
SIEM Alert Triage Engine
Python-based alert enrichment pipeline integrating VirusTotal, AbuseIPDB, and Shodan APIs to auto-classify and reduce false positives by 60%.
Custom Sigma Detection Rules
Vendor-agnostic Sigma rules mapped to MITRE ATT&CK TTPs targeting encoded PowerShell, process injection, and credential dumping techniques.
Memory Forensics Toolkit
Volatility 3 automation scripts for rapid malware triage — detects process hollowing, reflective DLL injection, and hidden rootkit artifacts.
Windows Event Log Parser
Python & PowerShell toolkit for parsing Sysmon EID 1/3/10 and Windows Security 4624/4625 events into structured threat timelines.
IOC Enrichment Bot
Automated IOC enrichment pipeline querying MISP, VirusTotal, and AbuseIPDB feeds — outputs structured JSON reports for analyst triage queues.
Zeek & Wireshark Lab
Home lab setup capturing and analyzing east-west network traffic with Zeek scripts and Wireshark display filters for C2 beacon detection.
Security Research & Writeups
SIEM Alert Triage at Scale — Cutting False Positives by 60%
Lessons from building correlation rules, tuning Sigma detections, and using Python to auto-enrich alerts with threat intel feeds.
Process Hollowing Detection with Volatility 3
Step-by-step walkthrough of using Volatility 3 malfind and pslist plugins to identify reflective DLL injection and hollowed processes in live memory dumps.
Writing Production Sigma Rules — From TTP Mapping to Deployment
How I map MITRE ATT&CK techniques to Sigma rule logic, validate against SigmaHQ schemas, and compile to Splunk SPL for enterprise deployment.
Building a Production-Grade SOC Home Lab with Wazuh
Complete architecture guide for deploying Wazuh Manager, agents, and Sysmon log pipelines on a virtualized enterprise environment for blue team training.
Ransomware Incident Response — A Student Analyst Playbook
Tabletop scenario documenting containment, eradication, and recovery procedures for a simulated ransomware attack across a multi-host Windows domain.
The Hardening Guide for Android
For anyone running pentesting, bug bounty, or security workflows off a daily-driver Android phone — no custom ROM, no root, no bootloader unlock. Just discipline.
Frequently Asked
Background, competencies, and availability for hiring managers and recruiters.
Who is Priyansh Khandal?
Priyansh Khandal is an MCA graduate student and Certified SOC Analyst (CSA) specializing in blue team defense, SIEM telemetry correlation, Sigma rule authoring, and digital forensics.
What roles is Priyansh actively targeting?
Entry-level to junior SOC Analyst (L1/L2), Detection Engineer Intern/Associate, and Junior Incident Responder roles across 24/7 rotational shifts — remote, hybrid, or on-site.
What certifications does Priyansh hold?
EC-Council Certified SOC Analyst (CSA), IBM Cybersecurity Analyst Professional Certificate, Google Cybersecurity Professional Certificate, and active top-ranked Blue Team track achievements on TryHackMe.
What hands-on lab experience does Priyansh bring?
A virtualized enterprise SOC home lab with Splunk Enterprise, Wazuh EDR, and Sysmon log pipelines. Active investigations on TryHackMe and Hack The Box, plus custom Sigma and YARA rules targeting adversary persistence and privilege escalation.
Where can SOC labs and detection rules be reviewed?
SOC labs and detection tools are published under Projects (/projects), technical writeups are under Researches (/researches), and open-source detection rules are available on GitHub (github.com/rootwithkhandal).
How can recruiters and security teams contact Priyansh?
Direct inquiries can be sent to ipriyansh@outlook.in or via LinkedIn (linkedin.com/in/priyanshkhandal). Available immediately for full-time SOC roles with 0-day notice.
Let's Connect
Actively seeking L1/L2 SOC Analyst roles, detection engineering opportunities, and blue team collaborations.
Open to rotational shifts — remote, hybrid, or on-site.
Connect for full-time SOC roles, referrals, and technical discussions.
Public detection rules, Volatility3 triage scripts, and IR playbooks.
Hands-on practice across SIEM, network defense, and memory forensics.
Direct inbox for interview scheduling, technical inquiries, and offers.