Apr 2022 – Dec 2023 · 1 yr 8 mos · Bangalore

• Reverse Engineering & Security Research ---
• Red and blue team research.
• Built several PoCs for Attack Surface Reduction (ASR) on endpoints (windows).
• Built PoC for cloud deception on Microsoft Azure.
• Contributed in the ITDR (Identity Threat Detection and Response)
• Worked on creating detections based on ETW (Event Tracing for Windows)
• Created detection rules for the Zscaler Deception
• Worked on honeypots across customer networks for threat intelligence
• Performed malware analysis and reverse engineering on detected threats
• Prepared case studies with detection rules to present to stakeholders.
• Created CTF challenges for internal and external events
• Co-ordinated with data science, engineering teams to improve detections
• Provided trainings to internal teams on hunting and investigation

Feb 2021 – Mar 2022 · 1 yr 1 mo · Bangalore

• Threat Hunting and Detection Engineering ---
• Contribute to threat research, detection rules, and technical blogs.
• Part of threat hunting engagements to identify new threats on customer tenants.
• Built a phishing infrastructure to gather credentials for a project PoC.
• Assisted a customer on Active Directory deception and attack detection
• Worked on attack simulators to generate attack data to validate detection logic.
• Track community released threat detections and map with Securonix's product.

Mar 2019 – Feb 2021 · 1 yr 11 mos · Sydney, New South Wales, Australia · Remote

• Intrusion Analysis, IR, Monitoring & Hunting ---
• Key contributor to threat hunting, intelligence and deception platforms
• End to end delivery and design of decoys after architecture review of customer networks
• Performing Active Directory assessment to find misconfigurations and loopholes
• Real-time security monitoring, threat hunting and incident response engagements
• Involved in forensic investigations and compromise assessments
• Did Mapping of rules and use cases with MITRE ATT&CK
• Worked on network threat mitigation for the findings
• Contributed to automation of Tier 3 Incident Response & evidence collection process
• Contributed to case studies and technical blogs

Feb 2018 – Mar 2019 · 1 yr 1 mo · Mumbai · On-site

• Security Engineering, Analytics, Hunting, AD Attacks ---
• Worked on security analytics projects for Innovation & Research (InR) department
• Built Active Directory infrastructure, and simulated attacks for AD security use cases
• Implemented server hardening and created automation scripts (using .bat, powershell, bash etc)
• Contributor in the Incident Response investigations for existing clients
• Performed regular log analytics using Elastic Stack
• Managed ELK operations team of 4 people from research department
• Contributed on the internal knowlege sharing and technical blogs on windows security

Jan 2015 – Jan 2018 · 3 yrs · Gurgaon · On-site

• System Administration, Hunting & Active Directory Security ---
• Worked on L3 incidents assigned by L1 team based on SLA defined
• Built a threat analysis platform using Sysmon & ELK for IT Security Team
• Manage all Active Directory domains and deploy GPOs to enforce security policies
• Coordinated with global IT and security teams on daily basis to resolve incidents
• Contributed towards patches for vulnerability management, and critical server backups
• Provide technical support to the staff and stakeholders