Open-Source-First SOC Platform
Designed and operate a Wazuh + Elastic SOC delivering SIEM, EDR, device management, and threat hunting across 25+ client environments.
WazuhElasticSplunkCribl
Security Engineer / Analyst (L2) · Hyderabad
Mithun
Kumar Chittimalla.
I break things before attackers do — then build the detections that catch the ones who try.
Cybersecurity professional with 3+ years designing, building, and operating end-to-end security across multi-tenant client environments — spanning offensive testing, detection engineering, and cloud/network architecture.
3+
Years in security
50+
Pentests reported
25+
SOC client environments
7
Certifications
02 / Selected Work
Things I've
built & broken.
6 of 6 projects
Multi-Tenant Threat Intelligence Platform
Built a threat-intel platform that aggregates indicators from diverse sources and shares enriched intel across client environments.
Threat IntelWazuhPythonAutomation
SOAR Automation Engine
Engineered automated detection-and-response workflows using n8n and Shuffle to accelerate triage, enrichment, and containment.
n8nShuffleSOARPlaybooks
Automated VAPT Report Generator
Built an automated report generator and re-engineered the org's reporting standards — improving consistency, turnaround, and deliverable quality.
PythonVAPTReportingDX
Repository Watchtower — FIM Tool
A lightweight file-integrity monitoring tool that detects, records, and alerts on file content changes, deletions, renames, and creations.
PythonFIMDefensiveMonitoring
ML Phishing-URL Detection
Classification models that flag phishing sites from URL, domain identity, and encryption signals — plus a deep-learning IDS for network anomalies.
Machine LearningPhishingIDSResearch
03 / Experience
Where I've
put my hands.
2024 — Now
Security Engineer / Analyst (L2)
iCompaas LLP
Hyderabad, India
Designing and operating end-to-end security across 25+ multi-tenant client environments — SOC, offensive testing, cloud, and automation.
- Designed and operate an open-source-first SOC (Wazuh, Elastic) delivering SIEM, EDR, device management, and threat hunting for 25+ clients.
- Performed and reported 50+ penetration tests across web, mobile, API, network, and cloud for fintech and Fortune 500 clients.
- Secured multi-cloud infrastructure (AWS, GCP, Azure) — cloud pentesting, IAM hardening, and least-privilege remediation.
- Engineered SOAR workflows (n8n, Shuffle) and a multi-tenant threat-intelligence platform with enriched cross-client intel.
- Built an automated VAPT report generator; led compliance, secrets management (HashiCorp Vault), and email security (Sublime, DMARC/SPF/DKIM).
2022 — 2024
Cybersecurity Operations (Internship)
iCompaas LLP
Hyderabad, India
Built Wazuh detection content, Python log integrations, and AWS security configurations while running client VAPT engagements.
- Deployed Wazuh SIEM detection content — custom correlation rules and decoders — to detect and mitigate SSH brute-force attacks.
- Engineered Python log-source integrations and file-integrity monitoring (Wazuh, OSquery) across diverse servers.
- Architected AWS security (EC2, S3, IAM, CloudTrail, CloudWatch, GuardDuty, Kinesis) and Cloudflare WAF/DDoS protection.
- Ran VAPT engagements remediating CORS, XSS, XXE, and SQL injection; reduced false positives by 30% via threat-intel integration.
Toolkit
VAPTBurp SuiteNmapWiresharkNessusSQLmapNiktoWazuhElasticSplunkAzure SentinelCriblDetection EngineeringThreat HuntingSOAR (n8n / Shuffle)AWSGCPAzureCloudflare WAFHashiCorp VaultPythonOSqueryZabbix / GrafanaDMARC / SPF / DKIM
04 / Certifications & Education
Paper that
backs the practice.
Certifications
Certified Ethical Hacker (CEH)
EC-Council
Cribl Certified Admin — Stream
Cribl
Cribl Certified User
Cribl
JNCIA-Junos
Juniper Networks
Network Essentials
Juniper Networks
MECPA — ADAudit Plus
ManageEngine
Python (91%)
Google
Education
2020 — 2024
JB Institute of Engineering and Technology
B.Tech, Computer Science & Engineering · CGPA 7.8
2018 — 2020
Narayana Junior College
Maths, Physics & Chemistry · 927 marks
2018
Ekalavya High School
Secondary School · CGPA 9.0
05 / Now
What I'm
doing now.
- Building
- Threat-intel + SOAR automation at iCompaas
- Securing
- Multi-cloud across AWS, GCP & Azure
- Learning
- Detection-as-code & cloud attack paths
- Tooling
- Cribl, Elastic, Wazuh, Shuffle
- Drinking
- Chai, filter coffee, unreasonably
06 / Contact
Let's make
something safer.
Open to senior security roles · Available for consulting. The fastest way to reach me is email — I read everything and try to reply within 48 hours.
- Phone
- +91 96420 45042
- Location
- Hyderabad, India