Jigar Hirani Resume

Splunk · Cribl · SIEM

Jigar Hirani

I build the path between raw logs and the SIEM: collect it, shape it, cut what nobody searches, and keep every field the security team needs.

Now at Rojo Integrations, building end-to-end observability for an AI-enabled integration platform.

Email me LinkedIn

Stage by stage

  1. 01

    Collect

    ~10k forwarders at 99.9% SLA

    Onboarded AWS (Splunk Add-on for AWS, plus Lambda, SQS and CloudWatch for custom sources), XDR, EDR, firewall and FortiGate data, with regex routing and filtering on the way in.

  2. 02

    Shape

    −3 TB a day, no field lost

    Windows Event Logs from ~1 TB to ~550 GB a day. Trend Micro EDR rewritten as compact CSV for 60–70% less storage. Edge Processor on-prem, and Cribl routes and packs to Splunk, S3 and Elasticsearch.

  3. 03

    Detect

    50+ alerts, 20+ dashboards

    Enterprise Security use cases for brute-force attempts and hosts that stop reporting, built with the security team, with alerts routed to Slack and ServiceNow.

  4. 04

    Extend

    2 add-ons on Splunkbase

    DigiCert One Add-on brings in certificate audit logs. Get Diag pulls diag files from forwarders through the deployment server. Plus custom search commands in Python.

Experience

  1. Splunk & Observability Engineer · Rojo Integrations

    End-to-end observability for an AI-enabled integration platform: metrics, logs and traces with Prometheus, Grafana, Loki and Tempo, plus Splunk and Datadog monitoring for procure-to-pay integration flows.

  2. Splunk Admin · Data Elicit Solutions, for Regeneron Pharmaceuticals

    Ran standalone, distributed and clustered Splunk at 10 TB+ a day. Every stage above, in production.

SIEM

  • Splunk Enterprise & Cloud
  • Enterprise Security
  • SPL

Pipelines

  • Cribl Stream
  • Ingest Processor
  • Edge Processor

Observability

  • Prometheus
  • Grafana
  • Loki
  • Tempo
  • Datadog

Code & cloud

  • Python
  • Regex
  • Shell scripting
  • Linux
  • HTML & CSS
  • AWS

Certifications

Writing

Starting this blogWhat I'll write about, plus a search that shows where your Splunk license is going.

Working on Splunk, SIEM or Cribl? Email is the fastest way to reach me.

LinkedInGitHubResume