SIEM · SOAR · Detection & Response Automation
I'm Pavel YushkevichSenior Security Platform Engineer
I design and build detection & response platforms, from the first log line to automated, auditable response. Log pipelines, SIEM, detection-as-code and SOAR with AI-assisted triage for regulated environments. I own the architecture, and I can build any part of it myself.
≈1 TB
security telemetry per day50+
log sources integrated~95%
MITRE ATT&CK coverage2–5 min
to first triage, down from 15–40
Profile
Security platform engineer who designs and owns detection & response platforms end to end, from log collection and enrichment through SIEM and detection-as-code to SOAR with AI-assisted triage.
I've spent 4 years in security operations. I started in a 24/7 SOC handling incidents from single endpoint alerts to multi-stage attacks. Since 2025 I've owned the security monitoring and automation platform at a globally regulated fintech with 1,500+ employees. The platform serves a ~30-person security team. Because I came from the SOC, I build what analysts actually need. Because I work in a regulated environment, I know what has to be logged, how long it has to be kept and how to prove it to an auditor.
I work at the architecture and roadmap level: design docs, build-vs-buy decisions, alignment with SOC, IT, engineering, compliance and business owners. When a project needs it, I personally ship the connector, detection rule or playbook that gets it live. Based in Warsaw, Poland, working remotely. Russian native, English C1, Polish basic.
How I work
Architect
Platform vision, design docs, build-vs-buy and reliability by design. Every piece is designed to be extended without touching the core.
Builder
Python connectors, pipelines, Sigma rules, SOAR playbooks and Terraform. I can deliver the critical path myself.
Operator
Former SOC analyst. Automation is designed around real triage workflows, with humans kept in the loop where it matters.
Education
Bachelor's, Information Systems and Cybersecurity
Vilnius University, Institute of Applied Informatics – 2020 – 2024
Information system security, OS security, ethical hacking, digital forensics and malware analysis, cryptography, network security, risk management.
Information Systems Management
School of Business of BSU, Minsk – 2019 – 2020
OOP fundamentals, IT project management, information systems governance.
The Platform
From the first log line to response
The reference architecture I designed and run in production at terabyte-per-day scale. Each stage can be extended with a template, without changing the core.
Collect
- Reusable connector framework for any API
- Webhook ingestion behind a WAF, buffered in SQS
- Syslog, streaming and file-based sources
- Centralized secrets management
Process & Enrich
- Per-source parsing and routing
- Normalization to a common schema
- Identity, HR, geo and infrastructure context
- Cached lookups at terabyte scale
Store & Search
- Scalable search cluster
- Retention aligned with regulation
- Raw backup + DLQ for replay
- Log-loss monitoring
Detect
- Detection-as-code with review and tests
- Automated rule deployment
- Behavioral analytics with baselines
- ~200 custom detections, ~95% ATT&CK
Orchestrate
- Custom SOAR core with queue-based workers
- Playbooks-as-code
- AI triage agents
- Approval workflows
Respond & Report
- Case management with full audit trail
- ChatOps and employee notifications
- Automation proposes changes via code review
- Scheduled management reports
Everything as code
Connectors, detections, playbooks and AI prompts live in GitLab. Changes go through MR review, tests and CI/CD, and git keeps the full history.
No event loss
SQS buffers ingestion and orchestration, so they survive orchestrator outages. Raw-event backups and DLQs allow replay. Failures are routed to error branches and alerted, never silently marked as success.
Humans in the loop
Auto-closure requires a deterministic external fact, and each class runs in shadow mode before go-live. Actions with consequences are enabled explicitly, and every automated step is visible in the ticket.
Case Studies
Selected work
Anonymized, production systems. Figures are conservative estimates from internal ticket data.
Enterprise SOAR on top of existing tools
- Challenge
- The business had already standardized on its ticketing system and a low-code orchestrator. Neither is an enterprise-grade SOAR on its own.
- Approach
- Designed a custom core around them: an API layer with queue-based workers, buffered event ingestion, a playbook format resolved at runtime per detection, and configurable approval rules.
Monitoring employee access to client PII
- Challenge
- Regulators and the business needed evidence that staff access to client data is controlled. Static thresholds were too noisy.
- Approach
- Access events from internal systems are scored by static rules plus a behavioral model with personal and peer-group baselines. Alerts land in case management, and analyst verdicts feed back into the platform.
Self-improving AI triage
- Challenge
- Analysts spent the first 15–40 minutes of every alert gathering context by hand.
- Approach
- AI agents with read access to the SIEM and case data post an enriched first verdict and follow up on new comments. Analyst decisions become feedback, and the system periodically proposes prompt improvements for review.
Secret exposure with content verification
- Challenge
- DLP secret-exposure alerts were mostly false positives, but the real ones were critical.
- Approach
- A detection flags the exposure, then an LLM checks whether the content is a real secret. False positives close automatically. For real hits, the employee is notified directly and the case escalates if needed.
Auto-closure with a deterministic gate
- Challenge
- Auto-closing alerts on an LLM opinion alone is not acceptable in a regulated company.
- Approach
- AI proposes the verdict, but closure requires an independent fact: a matching access approval, a privileged-access session record or verified content. Each alert class runs in shadow mode before it goes live.
Leaver watch
- Challenge
- Departing employees are a well-known data-exfiltration risk window.
- Approach
- HR offboarding data flows into enrichment automatically. Flagged users get a dedicated rule set and AI-reviewed activity monitoring, routed to the SOC.
Experience
Work experience
Security Engineer · SIEM / SOAR Platform Owner
Owner of the security monitoring and response platform at a global, multi-regulated fintech (1,500+ employees). The platform serves a ~30-person security team. I own its architecture, roadmap, delivery and stakeholder alignment.
Platform architecture & ownership
- Designed and own the detection & response platform end to end: collection → normalization → SIEM → detections → SOAR → case management. Authored the design docs and drove them through approval.
- Built a custom SOAR core instead of buying one. The business had standardized on its ticketing system and a low-code orchestrator, so I designed an enterprise-grade core around them: an API layer with Celery/Redis workers, SQS-buffered event ingestion, playbooks-as-code and configurable approval rules. Orchestrator outages lose no events, and a new playbook is one file in Git.
- Structured automation logic in three tiers (detection rule, Python tool, AI agent), so each problem is solved at the cheapest tier that works.
Data collection, SIEM & enrichment
- Built an in-house Python connector framework and scaled the platform to 50+ integrated sources (identity, endpoint, network, cloud, SaaS, finance systems, databases and streams), building, rewriting or maintaining their connectors.
- Run an OpenSearch SIEM ingesting up to 1 TB/day: per-source routing, normalization to a common schema, retention aligned with regulation, raw-event backup and DLQ for replay, log-loss monitoring.
- Designed the enrichment layer: identity and HR context, geo and IP reputation, infrastructure metadata, all cached to stay cheap at terabyte scale.
Detection engineering
- Introduced detection-as-code, the pipeline behind a library of ~200 custom detections, each backed by a SOAR playbook: Sigma rules in Git, review, automated tests and CI/CD deployment. Every new rule automatically gets a ticket, dedup, severity and AI triage. Behavioral scorers with baselines cover logic that rules can't express.
- Reached ~95% MITRE ATT&CK coverage of techniques relevant to company infrastructure, validated in annual Atomic Red Team simulations.
- Rolled out host telemetry and vulnerability detection across the fleet with Ansible. Evaluated Linux and Kubernetes telemetry down to the syscall level and defined CIS-aligned hardening requirements.
SOAR & AI-assisted response
- Built LLM triage agents with tool access to SIEM and case data. The first enriched verdict now arrives in 2–5 min instead of 15–40, and analyst time per alert is down an estimated 30–50%.
- Designed guardrailed auto-closure: an alert closes only on an independent fact (access approval, privileged-access session record, verified content). Each class runs in shadow mode first, and every action is visible in the ticket. Result: 50–75% auto-closure in covered classes, including 73% of DLP secret-exposure alerts on day one.
- Built a self-improving triage loop: analyst decisions become feedback, the system proposes prompt changes, and humans approve them through review.
Business, compliance & team
- Architected monitoring of employee access to client PII: static rules plus a behavioral model with personal and peer-group baselines, analyst verdicts fed back into the platform, and a weekly report for management. Also built leaver watch driven by HR offboarding data.
- Translated DORA, ISO 27001, GDPR and FCA / CySEC / SCB / MAS requirements into logging scope, retention and audit-trail design.
- Mentored SOC analysts and onboarded new engineers. Built MCP servers and AI skills for the team: Sigma generation and testing, tuning review, connector scaffolding.
SOC Analyst
- Led investigations from endpoint detections to multi-stage attacks, covering containment, remediation, vulnerability patching and reporting.
- Worked across SIEM tuning, network monitoring (Zeek, Suricata, Arkime), honeypots and DLP controls.
- Improved SOC workflows, mentored analysts and started the automation work that grew into the platform role.
SOC Analyst
- Worked in a large, mature 24/7 SOC: alert triage, threat hunting and detection-logic refinement to cut false positives.
- Handled incidents from simple tests to multi-stage attacks across multiple infrastructure layers.
- Wrote forensic artifact collection scripts for Windows, macOS and Linux.
Expertise
What I bring
Everything a security platform needs, from data to decisions.
Security Platform Architecture
End-to-end SIEM/SOAR design, build-vs-buy, design docs, roadmap. Reliability by design: buffering, DLQ, replay.
Log Engineering & Enrichment
Collection from any source: APIs, webhooks, syslog, streams, files. Normalization to a common schema, plus business and identity context enrichment at terabyte scale.
Detection Engineering
Sigma, detection-as-code with tests and CI/CD, behavioral analytics with personal and cohort baselines, MITRE ATT&CK.
SOAR & Automation
Custom SOAR core (Python/FastAPI, SQS, Kafka, Celery/Redis), n8n, playbooks-as-code, approvals, Jira and Slack.
AI for Security Operations
LLM triage agents with tool access, guardrailed auto-closure, feedback loops, MCP servers for engineers.
Compliance-driven Logging
DORA, ISO 27001, GDPR, FCA, CySEC, SCB, MAS: logging scope, retention, audit trail and evidence for auditors.
SIEM & Data
SOAR & Automation
Cloud & DevOps
Security Domains
AI Engineering
Frameworks & Regulation
Contacts
Let's build it
Need a SIEM that scales, a SOAR that fits your processes, or logging that passes an audit? Let's talk. I work remotely.
Architect by default, hands-on when it matters.
I design the platform, align it with the business and regulators, and personally ship the connector, detection or playbook that gets it live. The result is a working system.