Hugo Miranda
SIEM Engineer | Detection Engineering & Incident Response
- Detection Engineering
- Digital Forensics & Incident Response
- SIEM Operations
Operating a 23,000+ source IBM QRadar estate in financial services.
About
SIEM Engineer running a 23,000+ source IBM QRadar estate in financial services, where availability and log fidelity are the job.
Former security team lead, with hands-on time across QRadar, Elastic, SentinelOne and Azure Sentinel.
Work spans SIEM administration, detection engineering, incident response and log pipeline operations.
Experience
SIEM Engineer
2025 — PresentVolkswagen Financial Services
- Operate and maintain an enterprise IBM QRadar SIEM platform: upgrades, patching, rule and configuration changes, and controlled maintenance to preserve availability, integrity and performance.
- Administer QRadar components and supporting services across end-to-end log ingestion, parsing, normalization and search performance, aligned to operational SLAs.
- Manage roughly 23,000 log sources: onboarding, tuning, validation, decommissioning, and continuous health-checking for data completeness and fidelity.
- Cover 24/7 on-call rotations: incident triage, restoration, escalation coordination and structured troubleshooting to minimize MTTR.
- Support logging standards implementation to improve downstream correlation quality and detection engineering outcomes.
Network & Security Team Lead
2022 — 2025Jolera Inc.
- Led and mentored 5+ security engineers for 24/7 threat monitoring and incident response.
- Troubleshot and maintained security platforms across a multi-tenant MSSP environment.
- Mentored and trained junior security analysts.
- Produced incident reports and recommendations for senior management.
Earlier at this company
- Network & Security Operator — KB article maintenance; Elastic, SentinelOne and Azure Sentinel; incident, outage and performance alert response; escalation triage.
- Junior SOC Analyst — Audit reporting, risk and threat identification, security controls advisory.
IT Equipment Technician
2017 — 2020Fmtek
- Workstation setup and hardware diagnostics.
Featured Investigation
Fileless malware, end to end
Jolera Inc.
While leading the security team at Jolera, I ran a fileless malware investigation — the incident I point to first when the conversation turns to response work. The full technical writeup is being written up as a separate post.
Read the full writeup — coming soon
Certifications
Completed
Blue Team Level 1 (BTL1)
In Progress & Planned
- In Progress
Certified Junior Detection Engineer (CJDE)
- Planned
Elastic Certified Engineer
- Planned
Elastic Certified SIEM Analyst
Skills
- SIEM Platforms
- IBM QRadar 7.5.0Elastic Stack / Elastic CloudMicrosoft Sentinel (exposure)
- Detection Engineering
- Sigma rulesYARACorrelation rule tuningUse-case development
- DFIR
- Incident triageRoot cause analysisForensic timeline reconstructionThreat hunting
- Infrastructure
- rsyslog log pipelines (custom SEDL architecture)HPE ProLiant hardwareLog source lifecycle management at scale
- Networking & Protocols
- TCP/UDP log transportsyslogLog normalization & parsing
- Scripting & Query
- Bash / shellPowerShellAQLKQLEQL
Latest Posts
All posts →-
Tag Render Check
Temporary post used only to verify taxonomy and TOC rendering. First Heading Body text. Nested Heading More body. Second Heading Body text.
-
Hello World
My First Post This is my blog.
Contact
Open to conversations about detection engineering, DFIR and SIEM operations.