Varshali is available for hire
Hire VarshaliVarshali Nagrale
Verified Expert in Engineering
Detection Engineer and Developer
Toronto, ON, Canada
Toptal member since June 19, 2026
Bio
Varshali is a senior detection engineer with 8+ years of experience building and optimizing threat detection capabilities. She conducts threat hunting, improves SOC operations, and leads security initiatives across enterprise environments. Varshali specializes in Microsoft Sentinel, Splunk, SIEM engineering, MITRE ATT&CK mapping, incident response, and cloud security monitoring.
Portfolio
PwC
Splunk, Microsoft Sentinel, IBM QRadar, LogRhythm, ArcSight, Elastic, Azure...
PwC
SIEM, Endpoint Detection and Response (EDR), Cortex XDR, CrowdStrike, Firewalls...
Access 2 Networks
SBA, SentinelOne, SIEM, Analytical problem solving, FortiSIEM, Confluence...
Experience
- Information Security - 8 years
- Microsoft Sentinel - 8 years
- MITRE ATT&CK - 8 years
- SIEM - 8 years
- Endpoint Detection and Response (EDR) - 8 years
- Confluence - 8 years
- Jira - 8 years
- Splunk - 5 years
Work Experience
Threat Detection Engineer
2023 - 2025
PwC
- Designed and implemented threat detection rules across multiple SIEM platforms, including Splunk, Microsoft Sentinel, QRadar, LogRhythm, ArcSight, and Elastic, improving cross-platform visibility and detection consistency.
- Worked across multi-cloud environments, including AWS, Azure, GCP, and OpenShift (OCP), integrating cloud-native logs into SIEM for detection and monitoring.
- Engineered and optimized 50+ custom detection rules, models, and reusable frameworks to enable SOC analysts in identifying threats across hybrid environments, improving detection accuracy by 35%.
- Tuned SIEM and EDR rules, reducing false positives by 45% and significantly increasing the volume of actionable alerts.
- Integrated SOAR platforms to automate enrichment and triage workflows, leading to a 40% improvement in mean time to respond (MTTR) and enhanced analyst efficiency.
- Performed detection gap assessments using MITRE ATT&CK, closing 30+ high-priority visibility gaps, and enabling coverage across key TTPs in PRE, TA0001, TA0002, TA0005, and TA0007.
- Conducted deep analysis of network traffic and TCP/IP-level telemetry, firewall logs, endpoint activity, and cloud logs to detect anomalous behavior and exploitation patterns.
- Collaborated with cyber threat intelligence (CTI) teams to integrate emerging IOCs, TTPs, and malware signatures into custom detection content based on threat intel briefings.
- Developed Python and PowerShell automation scripts, enabling IOC-based correlation, alert enrichment, and automated prioritization.
- Conducted threat hunting using SIEM and EDR platforms, leveraging MITRE ATT&CK to identify stealthy adversary techniques and improve detection coverage.
Technologies: Splunk, Microsoft Sentinel, IBM QRadar, LogRhythm, ArcSight, Elastic, Azure, Google Cloud Platform (GCP), Security Orchestration, Automation, and Response (SOAR), MITRE ATT&CK, Python, Analytical problem solving, Confluence, Endpoint Detection and Response (EDR), Cortex XDR, CrowdStrike, SIEM configuration, Exabeam, Incident Response, IT Security, Cyber Threat Hunting, Vulnerability Assessment, Application Security, Cloud Security
SOC Analyst
2022 - 2023
PwC
- Demonstrated a rapid response to critical or high-severity security escalations during on-call duty, mitigating potential threats and safeguarding organizational assets.
- Investigated security alerts with SIEM and EDR technologies, including Cortex XDR and CrowdStrike.
- Developed comprehensive investigation playbooks or runbooks to guide analysts in efficiently and systematically investigating security alerts, streamlining incident response processes.
- Supported incident forensics by gathering evidence and conducting root cause analysis to enhance understanding of security incidents.
- Facilitated onboarding of new clients by participating in weekly meetings to establish standard operating procedures for the security operations center (SOC).
Technologies: SIEM, Endpoint Detection and Response (EDR), Cortex XDR, CrowdStrike, Firewalls, Checkpoints, Fortinet, Analytical problem solving, Incident Response, IT Security, Vulnerability Assessment, Application Security, Cloud Security
SOC Analyst
2021 - 2022
Access 2 Networks
- Monitored and triaged alerts from IPS, TrendMicro, SBA, MASS, and SentinelOne.
- Delivered 24/7 SOC coverage and supported incident response efforts.
- Configured customer firewalls, VPN tunnels, security profiles, and logging integrations with SIEM.
- Led day-to-day firewall operations, including rule updates, policy reviews, and access governance.
- Performed firewall configuration audits to identify misconfigurations, unused rules, shadow rules, and high‑risk objects.
- Worked closely with network engineers to validate firewall changes, NAT policies, and routing behaviors before production deployment.
- Investigated firewall‑related security incidents, including blocked traffic, lateral movement attempts, port scans, and VPN misuse.
- Collaborated with vendors (Checkpoint, Fortinet, and Palo Alto) for troubleshooting TAC cases related to firewall performance, blade errors, and connectivity issues.
- Conducted traffic analysis using SmartConsole, FortiView, and Palo Alto ACC to identify anomalies and recommend security enhancements.
- Created weekly health reports, managed customer vulnerability scans, and handled remediation.
Technologies: SBA, SentinelOne, SIEM, Analytical problem solving, FortiSIEM, Confluence, Endpoint Detection and Response (EDR), FortiEDR, Incident Response, IT Security, Vulnerability Assessment
Cybersecurity Analyst
2021 - 2021
Ruby Life
- Investigated incidents using Splunk, documenting findings in Jira to support incident response.
- Supported vulnerability scan assessments and validated security rules to strengthen system defenses.
- Authored detection playbooks and updated the team's knowledge base in Confluence to enhance operational efficiency.
Technologies: Splunk, Jira, Confluence, Okta, Firewalls, QualysGuard, Analytical problem solving, Endpoint Detection and Response (EDR), IT Security
SOC Analyst
2019 - 2020
M87 Cyber Security
- Triaged SIEM alerts and monitored endpoint or network activity to identify potential threats.
- Collaborated with business units to evaluate alert impact and coordinate timely responses.
- Assisted in documenting incidents and implementing containment and mitigation strategies.
Technologies: SIEM, Security Orchestration, Automation, and Response (SOAR), Firewalls, Endpoint Security, Antivirus Software, Analytical problem solving, IT Security
Testing Engineer
2016 - 2018
Reliance Jio Infocomm Ltd.
- Reviewed and analyzed system specifications, executed test cases, analyzed results, and reported bugs to the development team, enhancing overall software quality.
- Orchestrated post-release and post-implementation testing.
- Collaborated with management and technical team leaders to streamline day-to-day procedures, applying project management and QA methodologies for effective knowledge management.
- Designed, developed, and delivered an interactive knowledge management portal that supported call center employees for PAN India branches.
- Served as a subject matter expert (SME), developing FAQs and decision trees to troubleshoot and resolve customer issues, improving support efficiency.
Technologies: Software Testing, Agile QA, Quality Control (QC), Postman, ServiceNow
Project History
Detection Content Library
Built a reusable detection content library to improve scalability, consistency, and efficiency in enterprise SOC environments.
KEY CONTRIBUTIONS
• Developed reusable detection rules and threat hunting queries using KQL (Microsoft Sentinel) and SPL (Splunk) across endpoint, identity, cloud, and network telemetry.
• Standardized detection logic templates to ensure consistent structure, tuning methodology, and faster deployment across multiple client environments.
• Mapped detection content to the MITRE ATT&CK framework, improving attack coverage visibility and identifying detection gaps.
• Documented real-world attack scenarios, including phishing, privilege escalation, lateral movement, persistence, and credential abuse, with corresponding detection strategies.
• Created a structured SOC knowledge base for detection logic, query reuse, and investigation guidance to support analysts' onboarding and operational efficiency.
• Enabled faster development of new detection use cases and reduced duplication of effort across security engineering teams.
• Improved SOC collaboration and consistency in detection engineering practices across MSSP engagements.
KEY CONTRIBUTIONS
• Developed reusable detection rules and threat hunting queries using KQL (Microsoft Sentinel) and SPL (Splunk) across endpoint, identity, cloud, and network telemetry.
• Standardized detection logic templates to ensure consistent structure, tuning methodology, and faster deployment across multiple client environments.
• Mapped detection content to the MITRE ATT&CK framework, improving attack coverage visibility and identifying detection gaps.
• Documented real-world attack scenarios, including phishing, privilege escalation, lateral movement, persistence, and credential abuse, with corresponding detection strategies.
• Created a structured SOC knowledge base for detection logic, query reuse, and investigation guidance to support analysts' onboarding and operational efficiency.
• Enabled faster development of new detection use cases and reduced duplication of effort across security engineering teams.
• Improved SOC collaboration and consistency in detection engineering practices across MSSP engagements.
Education
2018 - 2019
Post-graduate Diploma in Cybersecurity
Centennial College - Toronto, ON, Canada
2011 - 2014
Bachelor's Degree in Computer Engineering
Mumbai University - Mumbai, India
Skills
Tools
Jira, Confluence, Splunk, IBM QRadar, Elastic, ArcSight, Azure Logic Apps, Postman
Platforms
CrowdStrike, SentinelOne, LogRhythm, Azure, Google Cloud Platform (GCP), QualysGuard
Languages
Python
Paradigms
Security Orchestration, Automation, and Response (SOAR), Software Testing
Other
MITRE ATT&CK, SIEM, Endpoint Detection and Response (EDR), Incident Response, IT Security, Microsoft Sentinel, Cortex XDR, Analytical problem solving, Cloud Security, Microsoft Defender XDR, Cyber Threat Hunting, SBA, SIEM configuration, FortiSIEM, Exabeam, FortiEDR, Okta, CyberArk, Checkpoints, Fortinet, Information Security, Network Security, Endpoint Security, Digital Forensics, Cyber Forensics, Cryptography, Threat Intelligence, Computer Networking, Software Engineering, Programming, Data Structures, Development, ServiceNow, Firewalls, Antivirus Software, Agile QA, Quality Control (QC), Vulnerability Assessment, Application Security
Collaboration That Works
How to Work with Toptal
Toptal matches you directly with global industry experts from our network in hours—not weeks or months.
1
Share your needs
Discuss your requirements and refine your scope in a call with a Toptal domain expert.
2
Choose your talent
Get a short list of expertly matched talent within 24 hours to review, interview, and choose from.
3
Start your risk-free talent trial
Work with your chosen talent on a trial basis for up to two weeks. Pay only if you decide to hire them.
Top talent is in high demand.
Start hiring