kiranc.me

Kiran Chandra

Senior Security Operations Engineer @ Capital One

At Capital One I run day-to-day security operations for a 14-analyst SOC and engineer the LLM agents that investigate cases, tune detections, and shorten response times.

  • Brooklyn, NY
  • GCIH · AWS Security Specialty
  • Incident response · Detection engineering · Shadow AI

~$ cat experience.log

Senior Security Operations Engineer

Capital One · New York, NY

2025-02 → present

  • Built an LLM-powered case investigation agent that ingests multi-source log data and generates structured case summaries, reducing mean time to resolve by 65%.
  • Lead SOC operations for a team of 14 analysts, coordinating escalations and driving incident resolution.
  • Engineered a detection-tuning agent that queries Databricks case telemetry, JIRA allowlists, and a GitHub detection-as-code library to surface tuning opportunities, replacing ad-hoc tuning with a weekly cadence.
  • Tune, manage, and investigate CrowdStrike Falcon detections aligned to MITRE ATT&CK across 86K endpoints, authoring custom IOA rules, scheduled NG-SIEM searches, and regex tuning logic.
  • Investigate shadow AI and unapproved tooling, including browser and IDE extensions, Claude skills, and MCP servers via Koi, and unauthorized Claude Code containers via detection-as-code alerts, driving remediation of 40+ critical issues and enforcement of sanctioned-only container configurations.

Security Operations Center Analyst

Capital One · McLean, VA

2023-08 → 2025-02

  • Triaged and resolved 1,000+ SOC cases end to end: investigation, enrichment, and escalation.
  • Rewrote and standardized SOC playbooks, improving incident handling across the team.
  • Partnered with software engineering teams on user acceptance testing and requirements validation for a new internal SOC case management system.

Help Desk Analyst

Your Tech Team LLC · Flemington, NJ

2022-09 → 2023-06

  • Provided IT support for a 184-bed hospital, administering Active Directory accounts.

Cybersecurity Intern

New York Life · Clinton, NJ

2022-06 → 2022-08

  • Automated email-security whitelist updates with Python, cutting malicious email by ~15%; analyzed and mitigated 100+ unique email threats using IronPort, Agari, and Anomali.

~$ ls -la ~/certs

Every badge links to its Credly credential page. Verify any of them.

~$ cat skills.txt

languages

  • Python
  • PowerShell
  • SQL

stack

  • CrowdStrike Falcon
  • AWS
  • Databricks
  • Proofpoint
  • VirusTotal
  • Wiz
  • Koi
  • Claude Code

~$ cat education.md

~$ ./contact.sh

> reach me on LinkedIn. genuinely happy to talk shop.

> curious how this site is built? see /security.

[process exited 0 · thanks for scrolling]