Subash Jaganathan

PwC India (PricewaterhouseCoopers Services LLP)

• Conduct comprehensive cybersecurity gap assessments across client environments, evaluating governance, processes and technical controls to baseline maturity and prioritize risk.
• Design, develop, implement and maintain information security frameworks and control programs aligned to ISO/IEC 27001:2022, NIST CSF 2.0, NIST SP 800-53 and other applicable industry standards.
• Perform risk assessments spanning cybersecurity & information-security risk, business continuity & operational resilience, and data protection & privacy.
• Develop and document security policies, standards, procedures and guidelines aligned to international standards, contractual requirements and organizational objectives.
• Lead independent third-party security assessments, audits and maturity evaluations, delivering clear, actionable and risk-prioritized recommendations.
• Support clients in improving cybersecurity maturity: risk management, control design, remediation planning and continuous-improvement initiatives.
• Deliver hands-on technical engagements spanning penetration testing (VAPT), SOC operations & detection, and digital forensics & incident response (DFIR) for enterprise and critical-sector clients.
• Assess and secure Operational Technology & IoT (OT / ICS / IoT) environments - governance, risk and technical controls for industrial, energy and critical-infrastructure clients.
• Manage client engagements end-to-end - RFP responses & proposal development, engagement planning, execution & delivery management, and stakeholder communication & reporting.
• Collaborate across IT, engineering, legal, compliance and business leadership and external stakeholders to drive security outcomes.

4i Apps Solutions Pvt. Ltd.

• Lead EDR/XDR monitoring & threat response with CrowdStrike Falcon: behavioural detection analysis, alert triage, host containment and remediation to minimize attacker dwell time and lateral movement.
• Drive end-to-end Incident Response engagements across endpoint, identity, network, cloud & application layers, covering scoping, forensic evidence acquisition, root-cause analysis, containment, eradication and post-incident reporting.
• Conduct memory, disk and live-response forensics with Volatility, KAPE and Velociraptor, reconstructing attack timelines to support legal and compliance requirements.
• Perform Cloud IR & SOC operations across AWS and Oracle Cloud, investigating cloud-native threats, misconfigurations, IAM abuse and anomalous workload, storage and compute activity.
• Run hypothesis-driven & IOC-based threat hunting across endpoint, identity, network and cloud telemetry, mapped to MITRE ATT&CK to surface stealthy persistence missed by automated controls.
• Enrich detections and IR with threat intelligence (AlienVault OTX, GreyNoise, CloudSEK); manage risk-based vulnerability management across 200+ servers with false-positive validation and remediation tracking.
• Lead email security operations: phishing, malicious attachment/URL analysis, BEC investigation and spoofing prevention (SPF/DKIM/DMARC).
• Deliver AI Security assessments: LLM threat modeling, prompt-injection testing and agentic-AI workflow evaluation; built Claude API and MCP integrations to accelerate SOC triage and investigation.
• Drove measurable reduction in MTTD/MTTR through continuous detection-use-case tuning and IR playbook improvements.

Ernst & Young LLP (Big 4)

• Delivered incident response & remediation for enterprise clients across India and international geographies, ensuring swift containment and recovery from ransomware and APT campaigns.
• Analysed & attributed multiple APT campaigns targeting Indian government clients, mapping adversary TTPs to MITRE ATT&CK and delivering classified technical reports with remediation roadmaps.
• Performed Windows, Linux, mobile and cloud forensics (Azure AD sign-in logs, AWS CloudTrail, storage access patterns) for unauthorized-access and data-exfiltration investigations.
• Conducted malware analysis & reverse engineering to extract IOCs and TTPs, plus dark web forensics, brand monitoring and proactive threat intelligence for banking & government sectors.
• Engineered detection rules and custom correlation logic across multiple SIEM platforms tailored to client-specific threat landscapes; led ransomware recovery and data restoration.
• Supported a foreign client with full-spectrum DFIR, SOC, MXDR deployment and brand monitoring while managing concurrent engagements under Big 4 delivery timelines.
• Presented investigation reports, executive summaries & remediation roadmaps to client CISOs, IT leadership and legal teams.

Equitas Small Finance Bank

• Ran SOC operations with IBM QRadar & CrowdStrike for an RBI-regulated bank: log analysis, SIEM monitoring, incident triage, alert escalation and threat response.
• Performed risk-based vulnerability assessments on 3,000+ servers, network devices and endpoints with Tenable Nessus, and 90+ application security assessments (Web & Android) aligned to RBI / PCI DSS.
• Conducted DFIR investigations including ransomware malware analysis with successful decryption of sensitive files during active incidents, restoring business continuity.
• Executed Purple Team assessments simulating real-world adversary techniques to validate and strengthen detection and response across SOC and IR teams.
• Integrated and tuned SIEM log sources across firewall, EDR, WAF and database platforms, improving detection coverage and reducing false positives.
• Participated in 2 RBI-IDRBT Cyber Drills, validating incident-response readiness and demonstrating regulatory compliance.

Information Security Governance Pvt. Ltd. (CAMS - Vendor)

• Performed risk-based vulnerability assessments on 1,200+ servers, network devices and endpoints, plus 60+ application security assessments, for one of India's largest financial infrastructure organizations.
• Conducted OSINT, threat hunting & cyber forensics for India's largest mutual fund company and a major bank: social profiling, email/phone enumeration, leaked-database discovery and exposed-asset identification.
• Investigated web attacks, server attacks, email crimes and dark web activity with evidence collection, artifact analysis and threat actor attribution.
• Delivered ransomware malware analysis with file decryption and data recovery across HDD, SSD, RAID and cloud during active IR engagements.
• Hardened Web Application Firewalls to full block mode for external-facing applications, reducing application-layer attack exposure; delivered enterprise security awareness training.

Techbylanz Business Solutions

• Performed application security & periodic vulnerability assessments across Windows and Linux backend servers for banking-sector clients using Nessus & Qualys.
• Executed penetration testing of external-facing banking applications, identifying exploitable vulnerabilities and delivering detailed findings with remediation guidance.
• Ran quarterly and half-yearly assessments across the sensitive banking application portfolio, with VAPT reporting aligned to RBI & PCI DSS audit requirements and KPI/KRI reporting.
• Conducted root-cause analysis of security incidents and drove remediation with development teams; delivered secure-coding awareness training.