Headline

Security Engineer @ BlackPerl | Certified Ethical Hacking Professional

About

I’m a Security Engineer specializing in Detection Engineering, Threat Hunting, Incident Response, and Digital Forensics (DFIR), currently working with BlackPerl DFIR. My work focuses on investigating security incidents, hunting for adversary behavior, developing and tuning high-fidelity detections, and validating detection coverage across endpoint, identity, email, network, and cloud environments. My foundation is in Digital Forensics. I’ve worked on 50+ forensic investigations involving Business Email Compromise (BEC), malware, financial fraud, and complex digital evidence, collaborating with corporate security teams, legal counsel, and government and law-enforcement stakeholders. That forensic background shapes how I approach detection engineering: understand how an attacker behaves, identify the artifacts and telemetry they leave behind, and translate those behaviors into actionable detection logic rather than relying only on signatures and IOCs. My core areas include: • Detection Engineering: KQL, Sigma, YARA, SIEM correlation rules, behavioral detections, false-positive tuning, and MITRE ATT&CK mapping across Microsoft Defender XDR, Splunk, Wazuh, and Elastic environments. • Threat Hunting: Hypothesis-driven hunting across endpoint, identity, email, network, and cloud telemetry using TTPs, IOCs, OSINT, and threat intelligence. • Incident Response & DFIR: Alert triage, containment, root cause analysis, forensic acquisition, memory and disk analysis, timeline reconstruction, evidence handling, and chain of custody. • Identity & Endpoint Security: Microsoft Entra ID, Defender XDR, Intune, Purview, SSO and MFA investigations, endpoint security, and security control validation. • Security Automation: Python, PowerShell, and Bash for alert enrichment, investigation workflows, log processing, and repetitive SOC tasks. I’m particularly interested in Detection Engineering, Threat Hunting, DFIR, Blue Team operations, and adversary behavior research, and I continuously explore new TTPs and detection techniques that can be applied to real-world investigations and defensive operations. Open to connecting with cybersecurity professionals working across detection engineering, threat hunting, incident response, DFIR, and security operations.

Location

Bengaluru

AI stack

antigravity

claude code

claude

codex

ollama

openai

Work experience

Security Engineer at BlackPerl, Jan 2026 - Present · 9 mos, Bengaluru, ● Lead security investigations and incident response across SIEM, XDR, IDS/IPS, and email security platforms, performing alert triage, containment, root cause analysis, and remediation coordination. ● Conduct hypothesis-driven threat hunts across endpoint, identity, email, and cloud telemetry using MITRE ATT&CK TTPs, behavioral patterns, IOCs, OSINT, and threat intelligence. ● Develop and tune KQL-based Advanced Hunting queries and custom detections in Microsoft Defender XDR, improving detection fidelity through continuous validation and false-positive tuning. ● Investigate Microsoft Entra ID authentication activity, including anomalous sign-ins, suspicious MFA events, Conditional Access failures, and privilege escalation indicators. ● Monitor browser security, Shadow IT/AI usage, phishing, malicious downloads, and data-exfiltration risks using SquareX Browser Detection and Response controls. ● Conduct purple-team exercises and attack simulations to validate detection coverage, identify telemetry gaps, and develop new detection use cases across endpoint, identity, and email environments.

Security Engineer at TerraEagle, Mar 2025 - Dec 2025 · 10 mos, Bengaluru, ● Conducted proactive threat hunting across endpoint, identity, email, network, and cloud telemetry to identify credential abuse, lateral movement, suspicious activity, and emerging attack patterns. ● Investigated and triaged 100+ daily phishing, malware, and security alerts using Microsoft Defender XDR, performing scope analysis, containment, and remediation coordination. ● Developed and tuned KQL-based hunting queries and Sigma detection rules, improving detection coverage across endpoint, identity, email, and cloud environments. ● Executed 120+ MITRE ATT&CK-mapped adversary simulations using Atomic Red Team and custom scripts to validate security controls and identify detection gaps. ● Assessed 850+ endpoints against CIS Benchmarks, identifying configuration weaknesses and recommending hardening controls for Windows, Linux, and specialized devices. ● Monitored external threats and leaked credentials using CloudSEK, translating threat intelligence findings into proactive investigations and defensive actions.

Senior Analyst at EY, Jul 2024 - Mar 2025 · 9 mos, Gurugram, ● Investigated suspicious authentication, malware, phishing, endpoint, privilege, and cloud security events to determine incident scope, impact, and remediation actions. ● Identified telemetry, logging, and visibility gaps across security platforms, recommending improvements to strengthen detection coverage and incident response readiness. ● Performed security control validation and attack simulations across endpoint, identity, email, and cloud environments to assess detection effectiveness and identify coverage gaps. ● Supported vulnerability and exposure management by correlating security threats with affected assets, prioritizing risks, and coordinating remediation with technical teams. ● Automated alert filtering, log enrichment, reporting, and repetitive investigation workflows using Python and PowerShell to reduce manual effort and improve SOC efficiency.

Digital Forensics Executive at SHREE ARTECH INDIA PRIVATE LIMITED, Jan 2024 - Jul 2024 · 7 mos, Jaipur, ● Led digital forensic investigations for 50+ clients across BEC, malware, financial fraud, and cybercrime cases, producing defensible forensic findings and investigation reports. ● Performed large-scale forensic acquisition across a 2,000+ device project, imaging 200+ laptops within one month while maintaining evidence integrity and chain-of-custody documentation. ● Conducted memory forensics, disk analysis, and timeline reconstruction to recover, correlate, and validate digital artifacts from diverse evidence sources. ● Collaborated with corporate security teams, legal counsel, and law enforcement agencies to analyze evidence, validate findings, and support complex investigations.

Digital Forensics Evidence Examiner at SysTools Software Pvt Ltd, Dec 2022 - Jan 2024 · 1 yr 2 mos, Banglore, ● Performed memory forensics, disk analysis, and timeline reconstruction to recover deleted data and identify critical digital artifacts supporting financial fraud and cybercrime investigations. ● Acquired, processed, and analyzed digital evidence using FTK, EnCase, Magnet AXIOM, and X-Ways, correlating artifacts across diverse evidence sources to support investigative findings. ● Conducted static and behavioral analysis of malicious email content, including macros, LNK files, ISO images, and HTML smuggling, identifying attack vectors and reconstructing attack timelines. ● Maintained evidence integrity, forensic documentation, and chain-of-custody records throughout investigations, ensuring defensible handling of digital evidence. ● Developed Power BI dashboards to track forensic KPIs, evidence acquisition metrics, and case workloads, improving visibility into investigation status and team priorities.

Education

Master of Business Administration, Information Technology, Sikkim professional University

BCA, Information Technology, Vinoba Bhave University