Software Engineering & Presales · Cybersecurity

Karan Chawla

I'm a software engineer working the seam between engineering and the customer - building the security data pipelines and detection systems behind enterprise deployments, then running the POCs and simulation environments that prove they work.

View my work Get in touch
Based in Los Angeles, CA Open to Software Engineer, Forward Deployed Engineer, Solutions Engineer Where California, Washington, New York, New Jersey, Florida, Texas and Remote Focus POCs · Data Pipelines · Customer-Facing Demos · Software Engineering
Karan Chawla
Scroll
0+
Production security pipelines built
0+
Security use cases automated for live simulations
0+
Enterprise POCs led, start to finish
0+
Telemetry sources normalized into one platform
0+
Technical articles published
About

Building at the edge of security and AI

I'm a technical presales engineer based in Los Angeles, working the seam between engineering and sales in cybersecurity. At Gurucul, I own the simulation environment end-to-end, partner directly with Sales on tailored simulations, and lead POCs that turn a security conversation into a signed deployment.

What makes that work is the engineering underneath it - I build the production data pipelines and detection use cases myself, so when a prospect asks a hard technical question in the room, I can answer it, or go change the platform to prove it.

Before Gurucul, I completed my Master's in Computer Science at USC, where I built ML pipelines for user behavior analytics. I'm now looking at Forward Deployed Engineer, Solutions Engineer, and Software Engineer roles where that same mix - hands-on build plus customer-facing delivery - is the job.

Based inLos Angeles, CA
CurrentlySoftware Engineer - Cybersecurity, Gurucul
EducationMS Computer Science, USC
Open toSoftware Engineer, Forward Deployed Engineer, Solutions Engineer
LocationsCalifornia, Washington, New York, New Jersey, Florida, Texas and Remote
ElsewhereLinkedIn · GitHub
Experience

Where I've worked

Feb 2025 - Present
Gurucul Solutions, LLC
El Segundo, CA
Software Engineer - Cybersecurity
  • Built 25+ production security pipelines using Logstash in a SIEM infrastructure spanning Kafka and ClickHouse, normalizing telemetry from 50+ sources (Zscaler, Google Workspace, CrowdStrike, Palo Alto) across 15+ enterprise customer environments.
  • Deployed a Sysmon-integrated endpoint agent across Windows and Linux for process, network, and file event telemetry, building the normalization parsers and ingestion pipelines behind it.
  • Delivered detection use cases spanning AI detection and response, ransomware, phishing, insider threat, and data exfiltration - using UEBA behavioral models and AI SOC triaging to cut incident response time from days to hours.
  • Establish customer data channels across HTTPS, TCP/UDP, REST APIs, Syslog, and Webhook integrations - mapping customer security infrastructure and onboarding telemetry sources into the platform.
  • Inherited a simulation environment with zero use cases ready whenever a customer simulation was scheduled - built the attack stories myself, ingested the data to simulate them, and trained detection models to flag them so AI could triage the results into real incidents.
  • Automated that ingestion to run daily, so incidents get created without anyone touching it by hand - own and maintain 5+ simulation environments end-to-end, with 30+ security use cases now simulation-ready at any time, supporting worldwide operations across time zones.
  • Partner directly with Sales to deliver 30+ tailored simulations and meet customer success criteria across 20+ POCs - translating technical capabilities into business outcomes for security teams.
  • Led 15+ POCs across finance, healthcare, manufacturing, and defense - scoping use case requirements, deploying the SIEM against live data sources, and presenting detection outcomes to CISOs and security architects.
  • Automated a syslog data collector deployment and validation framework for RHEL 9, Rocky Linux, Ubuntu, and Oracle Linux - SELinux policy, firewall hardening, SSL, SIEM connectivity - cutting provisioning time by roughly 60%.
  • Authored 8 technical articles on YARA rules, UEBA, insider threat detection, breach detection, and AI-assisted security operations, published on the Gurucul blog.
Aug 2024 - Feb 2025
University of Southern California
Los Angeles, CA
Data Engineer - User Behavior Analytics
  • Built a Python, Pandas, and Scikit-learn pipeline processing 1M+ user activity records daily.
  • Tuned Isolation Forest and Logistic Regression models to 95% anomaly-detection accuracy - a 40-point gain over the rule-based baseline - and shipped a Dash dashboard so non-technical stakeholders could act on detections directly.
Education

Where I studied

University of Southern California
Master of Science - Computer Science
Los Angeles, CAAug 2022 – May 2024
Mentored students in Information Retrieval & Web Search Engines and Data Science coursework.
University of Mumbai
Bachelor of Engineering - Computer Engineering
Mumbai, IndiaAug 2018 – May 2022
Skills

Tools I work with

Languages
PythonBash SQLJavaJavaScript TypeScriptC++
Security
SIEMUEBAIRM ITDREDRSOAR MITRE ATT&CKYARASysmon OktaEntra ID
Data & Streaming
KafkaLogstashSpark HadoopClickHouseCrateDBCribl
Databases
PostgreSQLMySQLMongoDB DynamoDBSnowflake
Cloud & Infra
AzureAWSGCP DockerKubernetes
Linux
RHELRocky LinuxUbuntu Oracle LinuxSELinuxsystemd firewalld
ML
Scikit-learnPandasIsolation Forest Logistic RegressionNumPy
Projects

Things I've built

Writing

Published Blogs

YARA Rules in the Gurucul Platform Threat Hunting → Exposed Identities: The Hidden Breach Risk You Can't Ignore Identity Security → When Trusted Access Turns Risky: An Insider Threat Case Study Insider Threat → The High-Performance Gateway to Analytics-Ready Security Data Data Ingestion → The 11-Minute Heist: Why Traditional Security Fails to Catch the Ghost in Your Network Threat Detection → Raw Logs Don't Stop Breaches - Context Does: Why Your SIEM Needs a Transformation SIEM Enrichment → One USB. No Network Traffic. No Incident. Now What? Insider Threat → The New Hire Was Never Real. The Access Was: Fraudulent Hire Identity Security →
Contact

Let's work together

Open to Software Engineer, Forward Deployed Engineer, and Solutions Engineer roles - California, Washington, New York, New Jersey, Florida, Texas and Remote.

Send an email LinkedIn GitHub