SUBASH
JAGANATHAN

4i Apps Solutions Pvt. Ltd.

• Lead EDR/XDR monitoring & threat response with CrowdStrike Falcon: behavioural detection analysis, alert triage, host containment and remediation to minimize attacker dwell time and lateral movement.
• Drive end-to-end Incident Response engagements across endpoint, identity, network, cloud & application layers, covering scoping, forensic evidence acquisition, root-cause analysis, containment, eradication and post-incident reporting.
• Conduct memory, disk and live-response forensics with Volatility, KAPE and Velociraptor, reconstructing attack timelines to support legal and compliance requirements.
• Perform Cloud IR & SOC operations across AWS and Oracle Cloud, investigating cloud-native threats, misconfigurations, IAM abuse and anomalous workload, storage and compute activity.
• Run hypothesis-driven & IOC-based threat hunting across endpoint, identity, network and cloud telemetry, mapped to MITRE ATT&CK to surface stealthy persistence missed by automated controls.
• Enrich detections and IR with threat intelligence (AlienVault OTX, GreyNoise, CloudSEK); manage risk-based vulnerability management across 200+ servers with false-positive validation and remediation tracking.
• Lead email security operations: phishing, malicious attachment/URL analysis, BEC investigation and spoofing prevention (SPF/DKIM/DMARC).
• Deliver AI Security assessments: LLM threat modeling, prompt-injection testing and agentic-AI workflow evaluation; built Claude API and MCP integrations to accelerate SOC triage and investigation.
• Drove measurable reduction in MTTD/MTTR through continuous detection-use-case tuning and IR playbook improvements.

Ernst & Young LLP (Big 4)

• Delivered incident response & remediation for enterprise clients across India and international geographies, ensuring swift containment and recovery from ransomware and APT campaigns.
• Analysed & attributed multiple APT campaigns targeting Indian government clients, mapping adversary TTPs to MITRE ATT&CK and delivering classified technical reports with remediation roadmaps.
• Performed Windows, Linux, mobile and cloud forensics (Azure AD sign-in logs, AWS CloudTrail, storage access patterns) for unauthorized-access and data-exfiltration investigations.
• Conducted malware analysis & reverse engineering to extract IOCs and TTPs, plus dark web forensics, brand monitoring and proactive threat intelligence for banking & government sectors.
• Engineered detection rules and custom correlation logic across multiple SIEM platforms tailored to client-specific threat landscapes; led ransomware recovery and data restoration.
• Supported a foreign client with full-spectrum DFIR, SOC, MXDR deployment and brand monitoring while managing concurrent engagements under Big 4 delivery timelines.
• Presented investigation reports, executive summaries & remediation roadmaps to client CISOs, IT leadership and legal teams.

Equitas Small Finance Bank

• Ran SOC operations with IBM QRadar & CrowdStrike for an RBI-regulated bank: log analysis, SIEM monitoring, incident triage, alert escalation and threat response.
• Performed risk-based vulnerability assessments on 3,000+ servers, network devices and endpoints with Tenable Nessus, and 90+ application security assessments (Web & Android) aligned to RBI / PCI DSS.
• Conducted DFIR investigations including ransomware malware analysis with successful decryption of sensitive files during active incidents, restoring business continuity.
• Executed Purple Team assessments simulating real-world adversary techniques to validate and strengthen detection and response across SOC and IR teams.
• Integrated and tuned SIEM log sources across firewall, EDR, WAF and database platforms, improving detection coverage and reducing false positives.
• Participated in 2 RBI-IDRBT Cyber Drills, validating incident-response readiness and demonstrating regulatory compliance.

Information Security Governance Pvt. Ltd. (CAMS - Vendor)

• Performed risk-based vulnerability assessments on 1,200+ servers, network devices and endpoints, plus 60+ application security assessments, for one of India's largest financial infrastructure organizations.
• Conducted OSINT, threat hunting & cyber forensics for India's largest mutual fund company and a major bank: social profiling, email/phone enumeration, leaked-database discovery and exposed-asset identification.
• Investigated web attacks, server attacks, email crimes and dark web activity with evidence collection, artifact analysis and threat actor attribution.
• Delivered ransomware malware analysis with file decryption and data recovery across HDD, SSD, RAID and cloud during active IR engagements.
• Hardened Web Application Firewalls to full block mode for external-facing applications, reducing application-layer attack exposure; delivered enterprise security awareness training.

Techbylanz Business Solutions

• Performed application security & periodic vulnerability assessments across Windows and Linux backend servers for banking-sector clients using Nessus & Qualys.
• Executed penetration testing of external-facing banking applications, identifying exploitable vulnerabilities and delivering detailed findings with remediation guidance.
• Ran quarterly and half-yearly assessments across the sensitive banking application portfolio, with VAPT reporting aligned to RBI & PCI DSS audit requirements and KPI/KRI reporting.
• Conducted root-cause analysis of security incidents and drove remediation with development teams; delivered secure-coding awareness training.