Sajid Kiani — SOC Consultant | Detection Engineering & AI Security

Sajid
Kiani

SOC Consultant | Detection Engineering, SOC Maturity & AI Security Specialist

Cybersecurity professional with 10+ years of experience across SOC operations, detection engineering, threat hunting, incident response, Splunk SIEM, cyber threat intelligence, SOC maturity improvement, and emerging AI/LLM security in telecom and managed security environments.

10+

Years in Cyber

8K+

Cybersecurity Reach

Certifications

Who I Am

Background

I am a cybersecurity professional specializing in Security Operations Center leadership, detection engineering, SOC maturity improvement, threat hunting, cyber threat intelligence, incident response, and emerging AI cybersecurity.

I currently work as a SOC Consultant, leading SOC operations across L1, L2, Splunk administration, and SIEM infrastructure functions. My work includes developing Splunk detection use cases, reviewing escalated incidents, improving alert quality, supporting DFIR investigations, and aligning SOC operations with customer, business, SLA, and regulatory requirements.

I have been associated with Cisco for more than six years. Previously, I worked as a Senior SOC Analyst, where I handled advanced investigations, threat hunting activities, incident response support, malware analysis, and detection logic enhancement for managed security environments.

I also focus on emerging AI cybersecurity areas, including LLM security, prompt injection risks, AI-assisted SOC operations, agentic AI security, and security monitoring challenges across modern AI infrastructure. My work spans hands-on detection engineering, analyst escalation review, incident investigation, SOC process improvement, AI security research, and cybersecurity publication.

sajid@soc ~ profile.sh

$ whoami

Sajid Kiani — SOC Consultant, Detection Engineering & AI Security Specialist

$ cat specializations.txt

→ SOC Maturity (SOC-CMM) · Detection Engineering · Splunk SIEM

→ DFIR · Threat Hunting · Malware Analysis

→ Cyber Threat Intelligence · Risk-Based Alerting

→ Team Leadership · SOC L1/L2 · Splunk Admin & Infra

$ echo $LOCATION

Riyadh, KSA | Islamabad, Pakistan

$ echo $STATUS

Open to international opportunities.

█

Key Achievements

DETECTION

Improved detection efficiency through optimized Splunk use cases, data model-based correlation searches, and better alert prioritization

MATURITY

Led SOC-CMM maturity improvement activities, supporting progression from Level 1 to Level 2 across key SOC operational domains

ALERTING

Implemented Risk-Based Alerting to reduce false positive noise, improve alert prioritization, and support risk-driven investigations

LEADERSHIP

Leading a multi-function SOC team covering L1/L2 monitoring, escalation handling, Splunk administration, and SIEM infrastructure operations

Career Timeline

2023 – Present

SOC Consultant

Cisco · Riyadh, Saudi Arabia

Lead SOC operations across L1/L2 monitoring, escalation handling, Splunk administration, and SIEM infrastructure functions
Develop and tune Splunk detection use cases using TSTATS, data models, summary indexing, and threat intelligence enrichment
Support Risk-Based Alerting implementation and tuning to reduce alert noise and improve investigation prioritization
Drive SOC-CMM maturity improvement activities across governance, people, process, and technology domains
Support onboarding of Microsoft Defender telemetry into Splunk with prioritized security log ingestion
Serve as escalation point for high-priority incidents, including DFIR investigation support and executive-level reporting
Align SOC operations with customer requirements, SLAs, regulatory expectations, and internal operational standards
Research AI cybersecurity risks, including LLM security, prompt injection, agentic AI workflows, GPU cloud security, and AI-assisted SOC monitoring scenarios

2019 – 2023

Senior Security Analyst

Cisco · Managed Security Services

Handled advanced security investigations and Tier 3 escalations across managed security service environments
Conducted threat hunting activities to identify suspicious behaviors, attack patterns, and high-risk indicators
Developed and tuned detection logic across Splunk and Carbon Black for managed customer environments
Supported malware analysis, incident response activities, and cyber threat intelligence reporting
Mentored L1/L2 analysts and improved escalation quality through structured guidance and investigation review
Maintained MITRE ATT&CK mapping for detection coverage and threat hunting activities

2016 – 2019

Assistant Manager — Cyber Security

Enterprise Organization · Pakistan

Managed day-to-day security operations — SIEM monitoring, alert triage, and incident escalation
Established vulnerability management processes and led remediation tracking across business units
Developed internal SOC procedures, playbooks, and escalation workflows
Supported regulatory compliance efforts including security audit preparation

2013 – 2016

Security Analyst

Early Career · Pakistan

Began career in SOC operations — alert monitoring, log analysis, and first-level incident handling
Built foundational expertise in network security, endpoint detection, and threat analysis
Pursued professional certifications and self-directed study in cybersecurity frameworks

Technical Stack

Core Expertise

SOC Operations & Leadership Detection Engineering Risk-Based Alerting SOC-CMM Maturity Assessment Incident Response & DFIR Threat Hunting Cyber Threat Intelligence Analyst Enablement Playbook Development

Tools & Platforms

Splunk Enterprise Security Splunk TSTATS & Data Models Splunk Admin & Infrastructure Microsoft Defender Microsoft Fabric Snowflake IBM QRadar Carbon Black MITRE ATT&CK Anomali ThreatStream Firewall / WAF / EDR / NDR

AI Cybersecurity & Research

LLM Security Agentic AI Security Prompt Injection Defense AI-Assisted SOC Operations GPU Cloud Security Kubernetes Security AI Model & Data Exposure Risks Secure AI Adoption

How I Can Help

SOC Maturity & Strategy

SOC maturity assessment using SOC-CMM
SOC process improvement and playbook development
SOC team training and analyst enablement

Detection Engineering

Splunk detection engineering and use case development
Risk-Based Alerting design and tuning
Threat hunting program development

Threat Intelligence & IR

CTI operationalization and IOC monitoring workflows
Incident response review and investigation support

AI Security Advisory

AI security research and advisory for SOC and enterprise security teams
LLM security risk review — prompt injection, data leakage, insecure tool use
AI-assisted SOC use case design — triage, enrichment, investigation summarization
Secure AI adoption for enterprise security operations

Available for consulting engagements, advisory work, and speaking opportunities.

Get in Touch ↓

Projects & Initiatives

SOC Maturity

SOC-CMM Maturity Improvement

Supported SOC maturity improvement activities across key operational domains — governance structures, analyst workflow optimization, detection coverage review, escalation quality improvement, and process documentation aligned to SOC-CMM requirements.

Detection Engineering

Splunk Risk-Based Alerting Implementation

Designed and tuned Risk-Based Alerting logic in Splunk Enterprise Security — improving alert prioritization, reducing noise through risk scoring and risk objects, and correlating user and asset behaviors into risk-driven investigations.

SIEM Integration

Microsoft Defender to Splunk Log Onboarding

Worked on prioritizing Microsoft Defender endpoint telemetry ingestion into Splunk — improving endpoint visibility, supporting detection use case development, and enhancing endpoint investigation coverage for SOC analysts.

Security Monitoring

Data Analytics Platform Security Monitoring

Developed security monitoring coverage for Microsoft Fabric and Snowflake environments — including data activity visibility, detection of abnormal access patterns and suspicious data movement, log onboarding into SIEM, and SOC use case development for data analytics platforms.

Threat Intelligence

CTI-Driven IOC Monitoring

Operationalized high-confidence IOC monitoring workflows — including SIEM correlation rules, historical log sweeps, tower-level threat reporting, and structured escalation handling for actionable threat intelligence findings.

AI Security Research

AI Security Research & SOC Enablement

Researching AI cybersecurity risks including LLM security, prompt injection, agentic AI workflows, and GPU cloud security — with a focus on practical SOC use cases for AI-assisted triage, alert enrichment, and incident investigation summarization.

Sajid
Kiani

Who I Am

Background

Key Achievements

Career Timeline

SOC Consultant

Senior Security Analyst

Assistant Manager — Cyber Security

Security Analyst

Technical Stack

How I Can Help

Projects & Initiatives

SOC-CMM Maturity Improvement

Splunk Risk-Based Alerting Implementation

Microsoft Defender to Splunk Log Onboarding

Data Analytics Platform Security Monitoring

CTI-Driven IOC Monitoring

AI Security Research & SOC Enablement

Writeups & Research

MICCMAC: Engineering Networks That Can Be Watched, Controlled, and Defended

Defensible Security Architecture: Think Like an Attacker, Act Like a Defender

SOC Maturity: Charting the Path Forward with the SOC-CMM Framework

The Human Element: Building and Nurturing a Skilled SOC Team

Tools, Frameworks, and Strategies for Effective SOC Operations

Building the Foundation for SOC Success

The Journey Towards SOC Maturity: Challenges and Opportunities

Risk-Based Analysis (RBA) in Cybersecurity: Reducing Alert Fatigue with Splunk RBA

SOC Engagement in a Multi-Layered Cybersecurity Breach

AI Confidence Is Not Cybersecurity Evidence

AI Runs on GPUs. But Who Is Securing the GPU Cloud?

Why Comprehensive Asset Management Is Your Best Defense Against Cyber Threats

Let's Connect

SajidKiani

Who I Am

Background

Key Achievements

Career Timeline

SOC Consultant

Senior Security Analyst

Assistant Manager — Cyber Security

Security Analyst

Technical Stack

How I Can Help

Projects & Initiatives

SOC-CMM Maturity Improvement

Splunk Risk-Based Alerting Implementation

Microsoft Defender to Splunk Log Onboarding

Data Analytics Platform Security Monitoring

CTI-Driven IOC Monitoring

AI Security Research & SOC Enablement

Writeups & Research

MICCMAC: Engineering Networks That Can Be Watched, Controlled, and Defended

Defensible Security Architecture: Think Like an Attacker, Act Like a Defender

SOC Maturity: Charting the Path Forward with the SOC-CMM Framework

The Human Element: Building and Nurturing a Skilled SOC Team

Tools, Frameworks, and Strategies for Effective SOC Operations

Building the Foundation for SOC Success

The Journey Towards SOC Maturity: Challenges and Opportunities

Risk-Based Analysis (RBA) in Cybersecurity: Reducing Alert Fatigue with Splunk RBA

SOC Engagement in a Multi-Layered Cybersecurity Breach

AI Confidence Is Not Cybersecurity Evidence

AI Runs on GPUs. But Who Is Securing the GPU Cloud?

Why Comprehensive Asset Management Is Your Best Defense Against Cyber Threats

Let's Connect

Sajid
Kiani