HEMANTH PVN

Built and scaled a 7-engineer cross-functional cyber automation team, establishing recruitment pipelines, onboarding standards, and a mentoring framework that transformed the function into Synchrony's primary SOAR delivery group.

Reduced Mean Time to Respond (MTTR) by approximately 30% through redesigned SOAR playbooks, automation scripts, and a documented threat intelligence workflow, significantly improving SOC operational efficiency.

Defined and reported key performance indicators (KPIs) for cyber automation, tracking metrics including SOAR use-case throughput, playbook adoption, and incident response efficiency to drive continuous improvement and inform leadership decisions.

Authored comprehensive SOAR governance documentation and use-case libraries, standardizing process knowledge across the team and reducing onboarding time for new analysts and developers.

Led the integration of Agentic AI into the SOAR platform to enable autonomous incident response and automated incident data enrichment, positioning the team at the forefront of next-generation security operations.

Managed individual and team contributions across SOAR, UEBA, SIEM, EDR, IDS, DLP, and phishing/social engineering detection initiatives, coordinating priorities across multiple concurrent security programs.

Led participation in penetration test reviews, identifying detection gaps and authoring After-Action Reports (AARs) that informed updates to incident response procedures.

Delivered training and technical guidance to the SOC team on security tooling, improving analyst proficiency and reducing escalation volume for routine alert triage.

Leveraged advanced Splunk Query Language (SPL) to develop high-fidelity content and alerting logic, improving detection accuracy and ensuring timely SOC notifications.

Developed use-cases and signature content across EDR, IDS, UEBA, and DLP platforms, correlating detections to strengthen the organization's overall security posture.

Built LUA and CEF parsers to optimize threat detection within Deep Packet Inspection (DPI) toolsets, improving network-layer security visibility.

Designed UEBA content and risk models to detect anomalous user and asset behavior, supporting earlier identification of insider threats.

Authored complex Splunk Enterprise Security (ES) correlation searches that materially expanded SOC alerting and detection coverage.

Upskilled in cloud security through self-directed study and applied observation, building foundational expertise ahead of formal role requirements.

Led incident response efforts for confirmed security incidents, coordinating cross-functional teams to contain, mitigate, and remediate active threats effectively.

Monitored and triaged security alerts and logs across IDS, UEBA, EDR, and SIEM platforms, identifying and escalating potential incidents in real-time.

Conducted root-cause investigations into security incidents, gathering evidence and analyzing attack patterns to assess organizational risk and impact.

Proactively threat-hunted for advanced persistent threats and unauthorized activity, identifying security gaps ahead of formal detection triggers.

Identified and analyzed security threats, including malware, unauthorized access, and anomalous network behavior, escalating high-severity incidents for immediate response.

Validated security alerts through log and network traffic analysis to confirm incident legitimacy prior to escalation, and authored remediation reports for management and the Incident Response Team.