Jagan Ravi

SIEM Administrator with 2+ years of hands-on Google Chronicle (Google SecOps) engineering experience across 20+ enterprise environments — spanning log ingestion, normalization, custom parser/DSM development, and correlation rule tuning. Onboarded and validated 1,500+ log sources and automate recurring SIEM tasks using Python. Working exposure to Gemini-powered AI capabilities within Google SecOps — including natural-language search, AI-generated case summaries, and AI-assisted YARA-L detection authoring — applied alongside traditional detection engineering to speed up triage and reduce analyst workload.

SIEM Administrator - HCLTech - Chennai

• Administer Google Chronicle (Google SecOps) alongside IBM QRadar, Splunk, Devo, and Cortex, supporting log ingestion, normalization, and case management across 20+ enterprise customers.
• Apply Gemini-powered natural-language search and AI-generated case summaries in Google SecOps to accelerate case triage and cut down manual investigation time on select high-volume cases.
• Use AI-assisted YARA-L detection suggestions within Google SecOps as a starting point for new detection logic, then manually validate and tune rules to production standards — combining AI speed with analyst judgment.
• Build custom DSMs and regex-based parsers for unsupported log formats, extending ingestion coverage and improving field extraction accuracy so data is clean and structured enough for downstream analytics and AI-assisted search.
• Integrate and normalize logs from Windows, Linux, Palo Alto, Fortinet, Cisco, and AWS, onboarding and validating 1,500+ log sources end to end into UDM-ready format.
• Design, implement, and tune correlation rules, use cases, and detection logic to reduce false positives and improve alert fidelity, informing which detections are strong candidates for future AI-driven automation.
• Write AQL and SPL queries, and increasingly use natural-language query interfaces, for detection logic development, threat hunting, event correlation, and troubleshooting across QRadar and Splunk.
• Build and maintain Splunk dashboards and searches to support log investigation, monitoring, and reporting for select engagements.
• Maintain incident response playbooks, SOPs, and documentation covering log source configuration and alert rationale; investigate offenses to support triage and case handling.
• Perform daily platform health checks and monitor EPS/ingestion utilization, using Python scripts to automate routine monitoring and reporting tasks.

Technical Support Engineer - Zoho Corporation - Chennai

• Diagnosed and resolved complex technical issues to improve system uptime and enhance customer satisfaction.
• Collaborated with cross-functional teams to align support workflows and reduce time-to-resolution for critical incidents.
• Implemented troubleshooting procedures that increased accuracy and consistency in identifying product defects.
• Documented technical problems and solutions to optimize knowledge sharing and accelerate team efficiency.

BTech - Cybersecurity & IoT - Sri Ramachandra Institute of Higher Education and Research (2019-07 - 2023-07)