SECURITY
Aerial view of an erupting volcano at dusk with glowing lava flowing down a dark slope.

VENUJAN MALAIYANDI

Security

Detection engineer turned builder. I know what defenders need, so I build it.

See More

01 / About_me

About_me

My rolling 2 years+ security career began in SIEM migration, and soon transitioned into detection engineering. Among my stack my strength lies Microsoft Sentinel, LogRhyhtm and Cortex XSIAM, whereas my trade had me specialize in dicy brown-field deployments where the stakes are greater .

The experience taught me what defenders actually need. Now I build it: vendor-neutral SOAR middleware and security tooling in C#, with Rust and C++ for systems work, designed so teams stay in control of what they run

Since January 2026 I work independently, overhauling SIEMs for MNC clients while building my own tools. Next up: Embedded Systems Security.

Focus
Detection engineering / SIEM / SOAR
Platforms
Sentinel, Splunk, Elastic, LogRhythm, FortiSIEM, Cortex, CrowdStrike, Tenable, Azure, Huawei cloud, AWS, GCP
Languages
Rust, C#, C++, KQL, Python, SystemgVerilog
Certs
Palo Alto Security Operations Professional, Microsoft SC-200
Education
BSc (Hons) Cyber Security, Wrexham Glyndwr University
Roles
Security Engineer, Detection engineer, SOAR engineer, Security analyst

02 / Works

Highlights

  • Sentinel detection library

    Problem
    Alert coverage was unmapped and noisy between day-to-day operations and migrations
    Approach
    400+ KQL analytics rules, each mapped to MITRE ATT&CK
    Result
    Coverage gaps closed
    [Private] link

  • Vendor-neutral SOAR middleware

    Problem
    Playbooks were locked to one vendor and one firewall
    Approach
    A .NET Core secure proxy layer between SOAR and on-prem firewalls and appliances
    Result
    Pow3rhell Binary deployable in Windows/Linux/Unix
    [Contact for demo] link

  • Sentinel ManageEngine integration

    Problem
    SOC needed an all in one platform case management for cases and existing SOAR
    Approach
    Scoped for ticketing platforms, and Sentinel integration methods
    Result
    Integrated SDP Ondemand with Sentinel, and Azure automation
    [Private] link

  • Dynamic entity mapping based SOAR

    Problem
    Affected entities were not traced back to affected company
    Approach
    Scoped for deployed identity and MDM providers. Configured provider and SIEM.
    Result
    Sentinel based Azure SOAR automation with multiple comms channels
    [Private] link

  • Bypass HA and log rotate limits

    Problem
    Certain cloud vendors (for some archaic reasons) did not provide native support for floating IPs among other technologies needed for high-availability without added cost of additional load balancing components. Additionally certain platforms's "Event Viewer" technologies were not compatible with proxy concepts
    Approach
    Comparing Arc Gateway and Private Links Performance for Sentinel
    Result
    PoC Docs, PoC implementations, Design Docs, Final Implementations
    [Private] link

  • Fixing early AWS Sentinel Connector

    Problem
    At the advent of Msft Sentinel introducing new connector for AWS, provided connector was unreliable interfered with client's exisiting cloud configs.
    Approach
    Identified multiple issues in their IaaC scripts and worked with established private vendor channels to disclose Sentinel backend bugs
    Result
    Msft Severity A tickets, Recorded Debug sessions for internal training, Confirmation Mail threads
    [Private] link

  • Comparing Arc Gateway and Private Links Performance for Sentinel

    Problem
    Needed to determine the performance vs impact of using arc gateway for enterprise firewall/proxy environments
    Approach
    Comparing Arc Gateway and Private Links Performance for Sentinel
    Result
    [Private]
    [Private] link

  • Custom Playbook Deployment for Tenable SC

    Problem
    Lack of SOAR automation for Tenable On prem offerings
    Approach
    Comparing Arc Gateway and Private Links Performance for Sentinel
    Result
    Internal Research report
    [Private] link

  • Monitoring and management of Log Collectors with Azure Arc

    Problem
    SIEM & logging infrastructure opens up as attack surface
    Approach
    Took a note of what each native platforms offered in logging, and proceeded to build from there
    Result
    Internal discovery reports, Design Docs, Final implementations
    [Private] link

  • Fix error 0x138C branching into EC2

    Problem
    Cannot send sysmon logs from WEF to WEC subscription with Error 0x138 (Permission error)
    Approach
    Modify Microsoft-Windows-Sysmon/Operational log permissions, WFE local users config
    Result
    Final Implementations
    [Private] link

03 / Contact

Contact

Hiring for detection, SOAR work or simply searching for more? Send a note and I will get right back to you.

[EMAIL]

Send email Open in Gmail LinkedIn