Mheboobkhan PathanGet in touch
resume

Mheboobkhan Pathan

Senior Threat Hunter, Microsoft R&D

01 Professional summary

Seasoned cyber threat hunter and incident responder with over 9 years of experience in identifying, analyzing, and mitigating sophisticated cyber threats. Proficient with advanced threat detection tools, thorough investigations, and robust security measures that safeguard critical information assets. Eager to apply mathematical concepts to solve real-world cyber security problems.

02 Work history

  1. Senior Threat Hunter, Microsoft R&D — Hyderabad, Telangana

    Nov 2022 — now
    • Incident responder and threat hunter for Microsoft’s MXDR service — advanced incident response and threat hunting for customers across many sectors, responding to threats for more than 60 customers.
    • Reduced alert noise by up to 40% by implementing an AI model that resolves known false positives by learning from historic grading.
    • Reduced data privacy incidents with a proof of concept that prevents PII from being delivered to unintended audiences.
    • Collaborate with engineering and PMs to deliver products efficiently; helped ship 4 major products to production.
    • Provided 2 major solutions to business problems that were adopted by leadership.
    • Respond to threats ranging from ransomware and cloud attacks to sophisticated malware; write project reports and coordinate with the team.
    • Guide and mentor junior team members.

  2. Senior Support Analyst, Nomura Holdings — Mumbai, Maharashtra

    Jun 2022 — Nov 2022
    • Developed advanced threat hunting strategies based on methodologies like the Pyramid of Pain and the Diamond Model.
    • Guided a team in executing the threat hunting program, moving the organization from purely intel-based hunting to IoA and TTP-based hunting.
    • Coordinated and executed purple team exercises.
    • Developed advanced threat detection logic and queries in Splunk, Elastic, and CrowdStrike.
    • Integrated threat hunting into daily operations using machine learning and AI.
    • Participated in incident response for major incidents.

    tools Splunk · SIEM · Python

  3. Security Consultant, IBM India — Mumbai, Maharashtra

    Mar 2020 — Jun 2022
    • Conducted regular threat hunts that uncovered multiple hidden threats undetected by existing security products, protecting the organization from monetary and reputational loss.
    • Led a team of four conducting threat hunting in customer environments.
    • Mapped threats on the MITRE ATT&CK framework against the organization’s threat landscape to keep a constant picture of the attack surface.
    • Collected and analyzed threat intelligence, including new attack vectors and APT campaigns, extracting indicators of attack (IoA) and compromise (IoC).
    • Performed threat modeling of external and internal attack surfaces to develop precise hunting hypotheses.
    • Developed use cases from hunting results to enhance detection capabilities.
    • Worked with incident response to eradicate threats found during hunts and conduct root cause analysis (RCA).
    • Prepared detailed reports and monthly presentations of hunt results for executive management.

    tools QRadar · TIP (Cyware) · AQL · Sysmon · YARA

  4. InfoSec Admin, NetConnect Pvt Ltd — Mumbai, Maharashtra

    Nov 2018 — Mar 2020
    • Developed security operations content: queries, templates, reports, rules, alerts, dashboards, and workflows.
    • Developed, implemented, and configured guides for the operations support team.
    • Migrated endpoints from Trend Micro to Sophos.
    • Diagnosed and resolved complex customer issues, designing solutions and facilitating deployment.
    • Contributed to unit-level and organizational initiatives.

  5. Antivirus Admin, IDC Technologies — Mumbai, Maharashtra

    Nov 2018 — Mar 2020
    • Deployed antivirus patches on endpoint devices.
    • Monitored antivirus signature updates on all scoped devices.
    • Troubleshot antivirus issues via the central console.
    • Collected and analyzed logs.
    • Prepared and maintained SOPs, weekly compliance reports, and risk reports.

  6. Desktop Support Engineer, ITSource Technologies — Mumbai, Maharashtra

    Mar 2016 — Jul 2017
    • Maintained compliance of antivirus systems.
    • Troubleshot agent issues.
    • Resolved user issues remotely and coordinated with the OEM.

03 Skills

hunt & respond
Threat Hunting · Incident Response · MXDR · Threat Intelligence · MITRE ATT&CK · Pyramid of Pain · Diamond Model · Purple Teaming · Threat Modeling · Detection Use Cases · RCA
platforms
Splunk · Elastic · CrowdStrike · IBM QRadar · Cyware TIP · Sysmon · YARA · Sophos · Trend Micro
code, data & ai
Python · AQL · SIEM queries · Machine Learning · AI

04 Education

  • B.Sc., Electronic Engineering — MH Saboo Siddik College of Engineering, Mumbai (2015)

05 Websites & profiles