Umang Solanki

Leads the Design and Implementation of the LogRhythm SIEM
platform, encompassing core components such as Platform
Manager (PM), Data Processor (DP), Data Indexer (DX), and
Sysmon agents.
Successfully executed a complete SIEM migration from legacy
ArcSight to LogRhythm, ensuring seamless Data Flow, Optimized
Performance, and Minimal Downtime.
Integrated multiple advanced security solutions — including Attivo
BOTsink®, Nexthink Cloud, Anomali TIP, RSA ECAT, CloudSEK
XVigil, Cisco IronPort, F5 ASM Bot, IBM Guardium, FortiGate,
Zscaler, FireEye, Arbor DDoS, O6ce 365, McAfee Web Gateway,
and many more — to enhance centralized visibility and Threat
Correlation.
Engineered a High-Availability, Load-balanced SIEM architecture
(Sysmon, PM, DP) with Optimized Licensing, Refined MPE parsers,
and Grafana-driven Health Monitoring to enhance Performance,
Resiliency, and Investigation e6ciency.
Developed and maintain custom MPE parsing rules for Telco
Business applications, enabling deeper visibility and tailored
Detection Logic.
Regularly evaluate and onboard new detection use-cases aligned
with the MITRE ATT&CK Framework, followed by detection
simulation & validation.
Conduct Threat Hunting for IOCs and tune Suspicious Detections
into actionable SIEM alerts.
Integrated Kibana with LogRhythm for enhanced log analytics and
investigative capabilities; design custom dashboards, metrics, and
reports for various operational and management audiences.
Mentor SOC analysts on SIEM and investigations, and advise
management on platform growth, security strategy, and SOC
optimization.
Manage and optimize Cisco Stealthwatch (SNA) for Enterprise
Network Tra6c Monitoring, Anomaly Detection, and Proactive
Threat Identification.

Investigated QRadar oGenses and produced actionable incident
reports, identifying key risks and improvement opportunities.
Delivered rule fine-tuning recommendations to reduce false
positives, consistently achieving 5+ KPI recommendations per
week.
Led weekly Team Meetings and Monthly Governance calls with
clients, ensuring alignment on security posture and incident
response.
Mentored and developed Team Members, enhancing Technical
Skills and SOC operational eGectiveness.

Implemented a distributed Splunk SIEM architecture, deploying
Search Head, Indexer, Deployment Server, and Forwarders for
Centralized Log Collection and Analysis.
Developed and fine-tuned Dashboards and alerts to enhance
Incident Response (IR) team e6ciency and Threat Detection.
Deployed Trend Micro Deep Security across multiple OS platforms,
including Policy Configuration and Endpoint Protection
Management.
Designed and managed a Vulnerability Management program using
QualysGuard, performing monthly scans, reporting findings, and
guiding remediation eGorts.
Administered ArcSight platform, maintaining core components
(Logger, ESM, and connectors) for operational health and
reliability.

Provided Cyberoam UTM Tech-support to Global Customers,
ensuring High-quality Service and Customer satisfaction.
Delivered Advanced Troubleshooting for installation, configuration,
network, and OS-level issues across Windows, Mac, and Unix
environments.
Achieved 75%+ First Day Resolution (FDR) on low-priority cases
and 85%+ CSAT consistently across consecutive quarters.
Handled Technical Escalations, serving as the Last Escalation Point
during Weekends & Night Shifts, achieving Team Response and
Resolution targets.
Mentored team members, conducted monthly training sessions,
and collaborated with development teams to implement Feature
Requests and resolve issues.