Kyle Ingrisano

Security Operations professional with hands-on full stack development and applied AI/ML experience, combining SOC/threat detection expertise (SIEM, KQL, MITRE ATT&CK, incident response) with software engineering (React, Node.js, REST APIs, cloud deployment) and AI-powered application development (LLMs, RAG, machine learning). Builds and secures applications end-to-end, bridging development, automation, and security operations.

Sr. Security Operations Analyst (SOC Analyst), Security Engineer (Vulnerability Management), Purple Team at Onestream Software (2025-03 – Present)

Led end-to-end security operations including incident response, threat hunting, and vulnerability management.

• Led end-to-end incident response across phishing, malware, insider threat, and cloud-based intrusions, reducing MTTR by 40%.
• Developed and tuned Microsoft Sentinel SIEM detections (alerts) mapped to MITRE ATT&CK, increasing true-positive rates.
• Built custom KQL queries to detect lateral movement, privilege escalation, and persistence activity.
• Created custom SIEM alerting rules and Azure Workbooks.
• Monitored and responded to security incidents using SIEM tools, Microsoft Defender, and Azure Sentinel within SLA.
• Investigated security alerts related to user risk, compromised credentials, and anomalous sign-in activities.
• Conducted log analysis and forensic investigations to determine the root cause of incidents.
• Developed Purple Team department and conducted regular tabletop exercises.
• Conducted proactive threat hunts using EDR and telemetry data (Defender XDR, Microsoft Sentinel, Rapid 7, Sentinel One, Okta), identifying unknown threats and gaps in detection coverage.
• Created hypothesis-driven hunts aligned to MITRE ATT&CK TTPs and documented results for knowledge base.
• Mentored Tier 1–2 analysts on triage and analysis best practices.
• Presented executive summaries of security incidents to management and stakeholders.
• Collaborated with GRC and Risk teams to align detection coverage with NIST 800-61 and ISO 27035 frameworks.
• Defined SOC KPIs including MTTR, false positive rate, and alert handling efficiency.
• Created custom reporting dashboards for CISO and senior leadership in Ironscales, ServiceNow, and SentinelOne.

Security Analyst | Azure Cloud Administrator at Bluelight IT (2022-02 – 2025-03)

Provided security operations and incident response support for phishing, malware, and cloud security.

• Analyzed, remediated and quarantined emails in Microsoft Defender and Avanan, identifying phishing, malware, and business email compromise (BEC) threats.
• Implemented custom anti-phishing rules and policies, reducing false positives and improving detection accuracy.
• Conducted header and message trace analysis to identify malicious senders and suspicious email patterns.
• Provided end-user phishing awareness training, reducing phishing click rates by 70%.
• Monitored and responded to security incidents using SIEM tools, Microsoft Defender, and Azure Sentinel.
• Investigated security alerts related to user risk, compromised credentials, and anomalous sign-in activities.
• Conducted log analysis and forensic investigations to determine the root cause of incidents.
• Managed Conditional Access Policies, Multi-Factor Authentication (MFA), and User Risk Policies to enforce secure authentication.
• Investigated privileged access misuse and potential insider threats.

Cyber Security Support Analyst (Vulnerability Management & SecOps) at Log(N) Pacific (2025-02 – 2025-03)

Internship focused on vulnerability management and security operations with threat hunting and compliance activities.

• Conducted vulnerability scans, provided detailed reports, and implemented PowerShell-based automated remediations, contributing to a 100% reduction in critical, 90% in high, and 76% in medium vulnerabilities.
• Performed vulnerability assessments and risk prioritization using Tenable across Windows and Linux environments.
• Executed secure configurations and compliance audits (DISA STIG) with Tenable to meet industry standards.
• Deep understanding of the "soft" side of Vulnerability Management: rapport, trust, transparency, and business need.
• Performed threat hunting with EDR, detecting IoCs from brute force attacks, data exfiltration, and ransomware.
• Designed, tested, and published advanced threat hunting scenarios for incident response tabletop exercises.
• Developed custom detection rules in Microsoft Defender for Endpoint and Azure Sentinel to automate isolation and investigation of compromised systems and created dashboards to monitor malicious traffic.
• Reduced brute force incidents by 100% by implementing inbound NSG/firewall rules to limit Internet exposure.
• Experienced with KQL (similar to SQL/SPL) which I used to query logs within the SIEM and EDR platform.

Founder | Full Stack Software Engineer (Independent Contractor) at K-ING Tech Solutions, LLC (2021-03 – Present)

Freelance/contract work performed part-time, outside core full-time employment hours. Full stack development, AI/ML application development, and DevOps/security services for small-business clients.

• Designed and delivered 15+ full stack web applications and automation solutions for 8+ small-business clients, owning front-end, back-end, database, API, deployment, and ongoing support end-to-end.
• Built responsive interfaces using React, TypeScript, JavaScript, Next.js, Tailwind CSS, and Bootstrap, improving average page load performance by ~30% and mobile performance scores by 20%+ across optimized client applications.
• Developed 20+ Node.js/Express.js REST API endpoints and backend services, implementing OAuth 2.0/JWT authentication and role-based access control (RBAC) to secure application and administrative functionality.
• Designed and maintained 10+ production databases using PostgreSQL, MySQL, MongoDB, and Redis; optimized schema design, indexing, and queries, reducing response times by up to 35% on high-use application queries.
• Developed AI-powered application features and workflow automations using Python, LLMs, prompt engineering, embeddings, and retrieval-augmented generation (RAG), reducing manual processing time by approximately 40% for targeted client workflows.
• Built and evaluated machine learning models using Python, Pandas, NumPy, and scikit-learn for classification, prediction, and process-automation use cases, including data preprocessing, feature engineering, and model performance tuning.
• Integrated generative AI and LLM APIs into web applications to support document analysis, data extraction, summarization, intelligent search, and conversational interfaces across 5+ client and internal projects.
• Deployed and maintained applications on Azure/AWS using Docker containers and serverless functions, reducing client hosting and infrastructure costs by approximately 20-25% while standardizing deployment environments.
• Built CI/CD pipelines with GitHub Actions and automated test suites (Jest, Cypress, Playwright), reducing manual deployment/QA effort by approximately 40% and catching defects before production release.
• Conducted secure code reviews and application security assessments across 10+ client projects, identifying and remediating 25+ security issues spanning OWASP Top 10 and CWE categories (authentication, authorization, input validation, dependency vulnerabilities).
• Managed 8+ client relationships end-to-end, requirements gathering, technical architecture, estimation, development, testing, deployment, documentation, and post-launch support, consistently delivering within agreed scope and timelines.

B.S. in Information Technology Management – Western Governors University (2027)