Detection engineering
KQL, MITRE ATT&CK mapping, use-case design and migration, and detection-as-code pipelines that validate a rule before it reaches production.
Cloud security architect · Kolkata, India
Kaushik SahaSecurity that holds when AI joins the SOC.
Twelve years in cybersecurity, from SOC analyst to architect. I design Microsoft Sentinel, Defender XDR and SOAR solutions for enterprise clients, and I build governed agentic AI — systems where models draft and people decide, with every step on the record.
- SC-100
- Microsoft Cybersecurity Architect Expert
- AZ-500
- Azure Security Engineer Associate
- 12
- Years in cybersecurity
What I work on
SOAR automation
Logic Apps, Azure Functions and Graph APIs for alert enrichment, identity containment and the ticketing work analysts should not be doing by hand.
Agentic AI for the SOC
LangGraph workflows with specialist LLM agents, human approval gates and Langfuse tracing — so AI assists triage and design without acting unchecked.
Securing AI systems
Prompt-injection boundaries, tool permissions and agent governance, mapped to the OWASP LLM Top 10 and the NIST AI Risk Management Framework.
Selected work
Built, tested, and honest about its limits
Some of this runs in private repositories. Happy to walk through the design in a conversation.
sentinel-triage-agent
PublicA LangGraph agent that triages a Microsoft Sentinel incident and stops for human approval before anything is dispatched. Deterministic enrichment and ATT&CK mapping run before any token is spent; incident text is treated as untrusted input. Runs with no API key.
- LangGraph
- Langfuse
- Python
- MITRE ATT&CK
Cyber Orchestrator
PrivateA governed multi-agent framework for security delivery: specialist agents for Sentinel design, KQL authoring, architecture review and documentation, run by a workflow engine with approval gates, an append-only audit journal and full LLM observability.
- LangGraph
- Langfuse
- MCP
- FastAPI
Architecture compiler
PrivateA Python engine that turns a schema-validated architecture model into editable enterprise diagrams, with AI generation behind deterministic confidence gates and an independent reviewer agent that cannot approve its own work.
- Python
- JSON Schema
- draw.io
- ADR-governed
azure-security
PublicA KQL learning path from first query to threat hunt, plus a Sentinel table library with sample logs and MITRE-mapped hunts, built so practitioners can learn the reasoning rather than copy queries.
- KQL
- Microsoft Sentinel
- Labs
Writing
Notes from the work
Governed agentic AI for cybersecurity
Why approval gates, independent review and an audit trail matter more than the prompts.
Langfuse for cybersecurity: an SOC lens
What to trace in a security workflow, and what must never be logged.
Detection-as-Code: the pipeline & governance
Version-controlled detections, validation gates and the review model around them.
Validating Sentinel detections in CI/CD
Catching a broken analytic rule before it reaches the production workspace.
Open to conversations about security architecture and AI in the SOC
Detection engineering, Sentinel and Defender delivery, or how to put guardrails around agents that touch production. LinkedIn is the quickest way to reach me.