Dublin, Ireland  ·  24×7 Global RSOC  ·  EMEA

Hemanth Kori

Most people are either a security analyst or a data analyst.
I spend my shifts as both.

RSOC Operator @ Synopsys  /  Data Analyst  /  PGDip Data Analytics

See the work Get in touch
the alert
fires at 03:00.
the model
says it was nothing.
the log
disagrees.
somebody
has to decide.

I watch a Fortune 500 estate for a living— then go home and build the models that explain what I saw.

“The data never lies — it just hides. My job is to find it.”  ·  ut supra, ita infra

0 Security alerts triaged per day
0 SLA on critical escalations
0 Faster BI reporting via automation
0 Papers published with a Zenodo DOI
I — The Ascent

From SOC floor
to statistical model

Seven years of a single through-line: get closer to the signal. Read it as an ascent through the spheres if you like; it was mostly night shifts and coursework. Penetration testing taught me how attackers think, analytics taught me how to prove it with numbers, and a global RSOC is where both get used in the same shift.

  1. Oct 2025 — Present

    RSOC Operator — Synopsys, Dublin

    24×7 Global RSOC · EMEA coverage · Regional Badging Admin

    • Triage 100+ security alerts daily in Splunk and Microsoft Sentinel, holding a sub-5-minute SLA on critical escalations.
    • Run full incident investigations — log correlation, IOC enrichment, threat-pattern analysis — escalating to Tier 2 against documented playbooks.
    • Monitor endpoint threats in CrowdStrike Falcon EDR: lateral movement, suspicious process trees, anomalous behaviour.
    • Analyse phishing, malware indicators and suspicious URLs; document every case in ServiceNow with post-incident write-ups.
    • Track MTTD / MTTR and feed security-posture reporting up to global SOC leadership.
    • Serve as Regional Badging Admin for EMEA — physical access control, identity badging and access governance across the region.
  2. 2023 — 2025

    PGDip Data Analytics — Dublin Business School

    Masters-level coursework · Two papers published to Zenodo

    • Time-series forecasting, statistical inference, machine learning and BI architecture at postgraduate level.
    • Published an ARIMA/SARIMA CO₂ forecasting study (MAE < 1 ppm) with a permanent DOI.
  3. 2022 — 2023

    Data Research Analyst — upGrad (Remote)

    ETL · Predictive modelling · Power BI & Tableau

    • Designed end-to-end ETL pipelines in Python (pandas, NumPy) for large-scale BI and predictive workloads.
    • Built interactive Power BI and Tableau dashboards, cutting reporting turnaround by 60% through automation.
    • Applied scikit-learn classification models to churn, ride-sharing and loan-approval datasets.
  4. 2021 — 2022

    SOC Analyst Intern & VAPT Trainee — Cyberspace Ltd / Targe Cyberspace

    SIEM monitoring · OWASP Top 10 · Python tooling

    • Monitored SIEM dashboards; performed alert triage, log correlation and escalation against SOC SOPs.
    • Conducted VAPT / WAPT on web applications and networks following OWASP Top 10 methodology.
    • Built Python GUI tooling with ML automation to compress repetitive security workflows.
  5. 2018 — 2022

    B.Tech, Information Technology — CMR University, Bangalore

    Algorithms · Networking · Systems

II — Works & Wonders

Things I built
to prove the point

Detection engineering, BI, and machine learning — all public on GitHub, all reproducible. No incantation required, though the KQL does look like one.

Detection engineering Microsoft Sentinel · KQL · MITRE ATT&CK

Microsoft Sentinel SOC Home Lab

Three production-style analytics rules for the attacks a Tier-1 analyst triages every shift: brute-force authentication (T1110), impossible-travel sign-ins (T1078) and after-hours privileged activity (T1078.004 / T1098). Each detection ships the KQL, the tuning notes, an ATT&CK mapping and a step-by-step investigation runbook — the same artifact a real SOC keeps for every alert.

View on GitHub
Business intelligence Power BI · DAX

Sales, Marketing & HR Dashboards

Three interactive Power BI dashboards with slicers, drilldowns and clean DAX measures — YoY revenue, CAC, marketing ROI and attrition rate — over reproducible datasets.

View on GitHub
Machine learning Python · scikit-learn

Loan Approval Prediction

Logistic regression, decision trees and random forest compared on a loan-approval dataset, with the full preprocessing chain and evaluation metrics kept in the repo rather than in a notebook comment.

View on GitHub
Data engineering Python · pandas · Matplotlib

Sales & Customer ETL Pipeline

Extract, transform and load over sales and customer data, ending in aggregated revenue by region — the unglamorous layer every dashboard quietly depends on.

View on GitHub
Classification Python · scikit-learn

Breast Cancer Classifier

Logistic regression on the breast-cancer dataset, reported honestly: confusion matrix, ROC curve and the metrics that matter when false negatives are expensive.

View on GitHub
Unsupervised Python · K-Means · PCA

Wine Clustering Analysis

K-Means over the Wine dataset with PCA for dimensionality reduction, plus the visualisations that make the cluster assignments arguable rather than asserted.

View on GitHub
Tooling Python · Tkinter · SQLite

Employee Management System

A desktop CRUD application — Tkinter front end, SQLite behind it. Built for the same reason SOC automation gets built: someone was doing it by hand.

View on GitHub
Scraping Python · BeautifulSoup

IMDb Ratings Scraper

Pulls titles, ratings and genres from IMDb with Requests and BeautifulSoup, then charts the ratings distribution. Small, but it is the acquisition step of every analysis above.

View on GitHub

All 26 repositories on GitHub

III — Capability

Two toolchains,
one operator

Security Operations
  • Splunk
  • Microsoft Sentinel
  • KQL
  • CrowdStrike Falcon EDR
  • ServiceNow
  • MITRE ATT&CK
  • Alert triage
  • Incident investigation
  • IOC enrichment
  • Phishing analysis
  • MTTD / MTTR reporting
  • VAPT / WAPT
  • OWASP Top 10
  • Access governance
Data & Analytics
  • Python
  • pandas
  • NumPy
  • scikit-learn
  • SQL
  • SQLite
  • R
  • ETL pipelines
  • ARIMA / SARIMA
  • Classification
  • Clustering & PCA
  • Power BI & DAX
  • Tableau
  • Excel 365 Advanced
Credentials
  • PGDip Data AnalyticsDublin Business School
  • B.Tech Information TechnologyCMR University
  • Irish Security Licence — PSA certifiedIreland
  • Machine Learning & AIupGrad
  • Python & DjangoupGrad
  • Data Science with RupGrad
  • Excel 365 AdvancedMicrosoft
  • In progress: CompTIA Security+ · Microsoft SC-2002026
IV — The Codices

Peer-archived,
not just posted

Two codices, archived on Zenodo with a permanent DOI and transcribed for laypeople on Medium. A DOI is the closest thing academia has to a binding sigil: once minted, it cannot be unmade.

DOI 10.5281/zenodo.16788044

Forecasting Atmospheric CO₂ Concentrations Using SARIMA Models

Time-series analytics on atmospheric CO₂, achieving a mean absolute error under 1 ppm. Rising CO₂ is one of the clearest human-driven climate signals we have; this models where the curve goes next.

Zenodo Medium
DOI 10.5281/zenodo.16788438

COVID-19, the Russia–Ukraine Conflict and the Automotive Industry

A data-analytics reading of two consecutive shocks to global automotive production — what the pandemic did to demand, what the conflict did to supply, and which effects were actually separable.

Zenodo Medium
V — The Side Quest

My mate exports coffee
I am the tech support

AnLee Ventures is an international trading company — sourcing, import/export and distribution, starting with green coffee and spices out of Coorg. It was founded by Vishnu Sharma, my chaddi buddy from college, who now lives in Latvia. I want to be clear that I co-founded nothing. I am the friend he rings when something needs building.

  1. 01

    Two tabs, zero synergy

    One window: a Sentinel query hunting impossible-travel sign-ins. The other: a freight quote and a disagreement about Incoterms. I am fluent in precisely one of these and I let you guess which.

  2. 02

    I now have opinions about beans

    Arabica, Robusta, grades A through AAA, and the fact that altitude genuinely matters. Six months ago I would have told you coffee came from a cafetière and gone back to my alert queue.

  3. 03

    Vishnu runs it. I am the phone call.

    He handles the suppliers, the paperwork and roughly what month it is. I registered a domain at midnight, pointed some DNS records at it, and have been describing that as “contributing” ever since. We have been friends since college, which is the only reason he tolerates my project management.

  4. 04

    I once wrote a university project on Latvian road freight

    Volumes and fuel consumption, 2014 to 2023. Vishnu now runs a trading company from Latvia. I would dearly love to present this as strategic foresight, but I picked that topic because the dataset was clean and the deadline was close.

  5. 05

    Status: extremely early

    The company is young. The website is younger. I am documenting it on a portfolio whose own banner says half baked site. At least the branding is consistent.

anleeventures.com Judge it gently, it is also under construction.

VI — Summoning

Open to SOC Analyst L2, Data Analyst and Security Engineering roles.

Based in Dublin, Ireland. Happy with hybrid or remote across EMEA. No circle of salt necessary — the summoning ritual is an email.

hemanthkori007@gmail.com