Karan Kisnani

Security Consultant & Engineer with 2.5+ years of experience in SOC operations, SIEM/SOAR engineering, threat detection, and incident response. Hands-on expertise with IBM QRadar and ELK/Wazuh, building detection rules, monitoring enterprise environments, and automating incident response workflows. Experienced in identity-related threat monitoring and authentication security, with a growing focus on Identity & Access Management (IAM) including Microsoft Entra ID, Active Directory, Okta, CyberArk PAM, SailPoint IdentityIQ, One Identity Manager, and Keycloak.

Skilled in integrating identity context into SIEM monitoring and detecting suspicious login activity to strengthen enterprise security posture.

Security Consultant at CtrlA Technologies & Consulting Service Pvt. Ltd. (2025-08 – 2025-12)

Security Consultant focusing on centralized logging, identity threat detection, and automated incident response workflows.

• Centralized logging from servers, firewalls, and authentication sources into ELK/Wazuh, enabling comprehensive identity monitoring across the enterprise environment.
• Developed detection rules identifying abnormal logins, impossible travel, credential abuse, and unauthorized access—reducing mean-time-to-detect (MTTD) for identity threats by 40%.
• Investigated authentication incidents by correlating identity context with threat intelligence feeds, improving alert fidelity and reducing false positives.
• Automated incident response workflows to disable compromised accounts and block malicious IPs within minutes of detection, aligning with Zero Trust principles.

Cybersecurity Engineer at Egyanamtech Pvt. Ltd. (2023-02 – 2025-05)

Led end-to-end IBM QRadar SIEM/SOAR implementation and identity lifecycle automation for financial institutions.

• Led end-to-end IBM QRadar SIEM/SOAR implementation for Bank of Abyssinia, covering architecture design, log source onboarding, correlation rules, and playbook development.
• Built SOAR playbooks to query Active Directory, validate account status, and automatically disable compromised users—cutting manual incident response time by 60%.
• Implemented automation for user access management including account enable/disable and password reset workflows via Active Directory (LDAP), streamlining identity lifecycle operations.
• Contributed to onboarding/offboarding processes by ensuring timely account provisioning and deprovisioning through SOAR workflows, reducing orphan account risk.
• Applied RBAC controls and maintained audit logs for all identity-related actions to support compliance and traceability.
• Automated response tasks using Python and Ansible; developed custom QRadar SOAR applications via SDK, extending platform capabilities for identity-focused use cases.
• Delivered 5-day hands-on training on QRadar SOAR workflows covering phishing, authentication failures, unauthorized access, and account compromise scenarios for a 12-person SOC team.

Bachelor of Commerce in Commerce – Savitribai Phule Pune University (2020 – 2023-01)