Cyber security expert, CISSP

Hired as a subject matter expert for DATA PROTECTION TEAM, as a Lead/Manager for DLP Program.
Responsibilities
Design and implement DLP and CASB solution covering endpoints, cloud apps and production systems.
Work with partner teams on planning and rolling out different detections on SOAR and Splunk platform specifically for DLP and
CASB solution. Configure, manage and monitor DLP solution, and respond to any DLP related incidents.
Set up and manage Data Protection Protection Team and team members which includes hiring of right candidate and training
them for day to day DLP operations.
Proactively search for potential threats that may exist within an organisation's network or systems. Demonstrate experience in
responding to security incidents, including identification, containment, analysis, and resolution.
Document incident response activities, including findings, analysis, and remediation steps and participate in incident response
tabletop exercises to test and improve incident response plans.
Develop detection rules based on TTP's to identify and mitigate advanced persistent threats, aligning with the MITRE ATT&CK
framework to enhance visibility and effectiveness of Security Intelligence Team.
Partner closely with business units and Legal Team to enhance the dependability and accuracy of security alerts, through close
collaboration and coordination.
Communicate and collaborate effectively with both technical and non-technical stakeholders with emerging security threats,
vulnerabilities, and trends, and share knowledge with the broader security team.

Responsibilities
Lead and build the new initiative of Insider Threat Program/Operations within the organisation.
Coordinate and collaborate well with the cross functional partner teams such as Legal, Privacy, Engineering, and GSA for efficient
and large scale response for DLP and Insider Threat program.
Build a team for Insider Risk Program which included creating detections, training team members and assist them to handle any
Insider risk incident diligently.
Monitor and perform investigation of security incidents and notables triggered in XSOAR and Splunk respectively, perform log
analysis of digital information, gather evidences, analyse root cause and perform containment and mitigation.
Primary resource for handling MDCA (Microsoft Defender for Cloud Apps) and MDE (Microsoft Defender for Endpoint) on a daily
basis and assist in creating advance threat hunting use cases based on daily observation.
Responsible for configuring, designing and implementing DLP and CASB capability along with policy creation, updating and
modifying the policies on DLP tool. Creating SOP's for new use cases.
Work closely with Incident response team in case of any true positive alert and help to develop IR initiatives
Perform quality analysis task in order to handle incidents more efficiently within the SLA, maintaining minimum MTTA, MTTR and
MTTC.
Monitor and work on security of GCP, AWS and Azure infrastructure on the daily basis and take necessary action on the alerts
triggered.
Provide input for use case enablement, fine tuning use cases in order to reduce false positives, update play-books as an on-going
process of improvement.

Worked as a Consultant with IT Advisory - Risk Consulting practice of KPMG India.
Responsibilities
Digital UPI Client: Responsible for understanding their UPI and wallet network architecture and create high level and low level
network diagram. Two largest public sector banks: Assisted in making RFP for the engagement conducting comprehensive
security assessment activities. Indian manufacturer of kitchen appliances and cookware: Assisted forensics and legal team for the
incident response of the breach.
Responsible for performing risk or gap assessment for the clients based on frameworks like NIST Cyber Security Framework and
ISO27001 for managing and improving client's overall cybersecurity posture.
Responsible for performing data inventorization and data classification and further creating data flow diagram for different
business units. Led Forcepoint DLP solution implementation, designed high level network architecture and implemented related
components.
Analysing the use cases created by 3rd party vendors for Azure AD, VPN, and IDS/IPS and responsible for real time monitoring of
alerts detected by CrowdStrike EDR and was involved in monitoring of alerts raised Cofense PhishMe Tool.
Understanding MITRE ATT&CK framework in order to establish and guide threat hunting team who will be responsible for
proactively and iteratively searching through networks to detect and isolate advanced threats for different log sources
leveraging different security solutions like CrowdStrike EDR, Splunk Enterprise.
Understanding client's network and assist them with content filtering and managing protection at DNS level using clouddelivered
security solution (Cisco Umbrella ODNS).
Responsible for analyzing and purging potentially harmful or high risk emails with dangerous attachments or viruses or any
phishing emails from all the mailboxes in our organisation.
Preparation of Security Incident response procedures and SOP of the technology solutions.
Assisting client in setting up 24*7 SecOps Team that included training all the team members for the smooth transition. Help the
team in monitoring and reporting any phishing alert, understanding MITRE ATT&CK framework in order to analyze the threat
scenarios more efficiently.
Managing the SecOps Team and responsible for presenting weekly SecOps Team update to the higher management.