§1 About

Threat hunter and incident responder with 9+ years in cyber security. I hunt for Microsoft’s MXDR service and write about applying probability to real-world security problems.

hypothesis, not hunch

Hunts built on MITRE ATT&CK, the Pyramid of Pain, and the Diamond Model — moving from intel-only hunting to IoA and TTP-based hunting.

less noise

AI and ML where they measurably help the analyst — like cutting alert noise by up to 40%.

teach it forward

Guiding and mentoring junior team members, and leading hunt teams.

§2 Experience full resume →

1. Nov 2022 — now

   Senior Threat Hunter, Microsoft R&D

   Incident responder and threat hunter for Microsoft’s MXDR service across 60+ customers; cut alert noise by up to 40% with AI; helped ship 4 major products.

2. Jun 2022 — Nov 2022

   Senior Support Analyst, Nomura Holdings

   Guided the threat hunting program from purely intel-based to IoA and TTP-based hunting; purple team exercises; detections in Splunk, Elastic, and CrowdStrike.

3. Mar 2020 — Jun 2022

   Security Consultant, IBM India

   Led a four-person hunt team; mapped threats to MITRE ATT&CK; turned threat intelligence and APT research into IoAs, IoCs, and detection use cases.

§3 Selected work

1. [1]

   AI false-positive resolutionai / detection

   Implemented an AI model that resolves known false positives by learning from historic grading, reducing alert noise by up to 40%.

2. [2]

   PII delivery preventionprivacy

   Built a proof of concept that prevents PII from being delivered to unintended audiences, reducing data privacy incidents.

3. [3]

   Products & solutionsengineering

   Worked with engineering and PMs to ship 4 major products to production; 2 of my solutions were adopted by leadership.

on github all repos →

1. gh

   ShadowMandatePython

   Bayesian-network drift detector for AI agent logs — scores behavior against generic bad-pattern rules and each agent’s own declared mandate.

2. gh

   twitter_ctiGo

   Twitter IOC hunter — parses IPs, URLs (fanged and defanged), and hashes.

3. gh

   threathuntingwithpythonJupyter

   Machine learning tools for threat hunting, from baselining to threat detection.

4. gh

   SycthPython

   Recovers passwords from crackme binaries using angr symbolic execution.

5. gh

   garakfork

   Fork of NVIDIA’s garak, the LLM vulnerability scanner.

§4 Writing all posts →

§5 Skills

hunt & respond

Threat Hunting · Incident Response · MXDR · Threat Intelligence · MITRE ATT&CK · Pyramid of Pain · Diamond Model · Purple Teaming · Threat Modeling · Detection Use Cases · RCA

platforms

Splunk · Elastic · CrowdStrike · IBM QRadar · Cyware TIP · Sysmon · YARA · Sophos · Trend Micro

code, data & ai

Python · AQL · SIEM queries · Machine Learning · AI

§6 Education

• educationB.Sc., Electronic Engineering — MH Saboo Siddik College of Engineering, Mumbai (2015)