Cyber Security Consultant at Deloitte
SOC AnalystSecurity Engineering
I investigate and respond to threats in a 24/7 security operations centre, then build the queries, playbooks and tuning that make the next investigation faster.
Two client engagements at Deloitte, from a 200-analyst global SOC to a multi-client MXDR service.
Deloitte to present
Day to day in the SOC: triage, investigation, containment and clear communication.
AiTM phishing, credential theft, DCSync attempts, malware infections, persistence and post-exploitation. Correlated identity, endpoint, email, network and threat-intelligence evidence to establish scope, root cause and user impact.
3–4 per shift, including multi-stage malware taking about an hour each from analysis through remediation and updates to affected users and management.
Execution, persistence, privilege escalation, lateral movement and command-and-control across endpoint, identity and network telemetry, using Defender XDR, CrowdStrike Falcon, Sentinel and Chronicle SOAR.
Monitored and contained malware on legacy Windows 7 and 10 systems, including spread through removable-media software transfers, while keeping production running where isolating an endpoint would have stopped it.
PowerShell telemetry, IOC-driven searches, CrowdStrike endpoint data and Metabase analysis to surface suspicious execution and persistence.
Building the tools, logic and process that let the SOC investigate faster and with less noise.
Led cross-functional tuning as new clients came online: refining detection conditions, suppression and severity until analysts saw signal instead of noise.
A reusable investigation framework that brings everything about a suspicious email into one view: sender and authentication results, links, attachments, user clicks, remediation and user reports. It adds automated risk indicators and a score-based verdict, and covers reported emails, malicious URLs, URL clicks and AiTM phishing.
Cut initial triage from 5–15 minutes to 1 minute per alert, across 50–70+ email alerts per shift.
The official KQL-based playbook for identity-risk investigations. Correlates interactive and non-interactive sign-ins, audit, Office activity, inbox rules and Entra ID risk to judge compromise and token persistence.
Adopted by 15 analysts across 8 clients, for 20+ investigations a day.
Worked with engineering to cut false positives: for example, moving curl detections from broad command-line substring matching to process-aware execution conditions.
Plus suppression and severity calibration across identity, endpoint and email detections.
1–2 month onboarding cycles: scripted agent deployment, Velociraptor and Trex coverage checks, telemetry health and cross-tenant Sentinel and Defender configuration.
Helped grow the SOC from 1 to 8 clients in 14 months.
Real attack types from my casework, mapped to MITRE ATT&CK.
Phishing pages that proxy the real sign-in to steal session tokens and bypass MFA.
Attempts to pull password hashes from domain controllers by impersonating replication.
Stolen tokens reused after a password reset, found through non-interactive sign-ins.
Mailbox rules that hide or forward mail so an attacker can stay unnoticed.
Execution, privilege escalation and command-and-control traced across the endpoint.
Attackers moving from the first foothold to other hosts and accounts.
Malware carried into production networks on USB drives used to transfer software.
What attackers do after getting in: discovery, staging and attempts to dig in deeper.
to
National Forensic Sciences University (NFSU), Gandhinagar
CGPA 8.56 / 10
to
Osmania University, Hyderabad
CGPA 8.34 / 10
Journal paper, accepted for publication
International Journal of Electronic Security and Digital Forensics
Analyzed forensic artifacts, memory behaviour, encryption and anonymized network traffic on three privacy-focused operating systems, to show where investigators get stuck and propose improvements.
Academic project
Simulated IDOR and privilege-escalation flaws, documented the exploitation paths, and proposed secure role-based access control fixes.
Small tools I build outside work, for chores I'd rather automate.
Scheduled restarts for home routers that can't restart themselves, driven from Windows, with an Android app that alerts when the router is up but the internet is down. Credentials stay in Windows Credential Manager or the Android Keystore.
Python, PowerShell, Java for Android. Open source, MIT licence.
An offline Android app that reads our team's colour-coded monthly roster, from Excel or a screenshot, and posts everyone's shift each morning at 6 AM. Text recognition runs on the phone: no server, account or internet.
Kotlin, Jetpack Compose, ML Kit. Shared privately with my team.
Happy to talk about security operations, incident response and security engineering. Email is the quickest way to reach me.
Based in Telangana, India