Santosh Krishnan

Player-coach SIEM platform owner and technical response lead with 15 years in security operations across financial services (BlackRock), healthcare, government, and higher education. Accountable owner of enterprise SIEM platforms end to end — log source onboarding across 50+ sources, detection content (120+ custom correlation searches), dashboards for SOC, executive, and compliance audiences, and continuous tuning. Led CrowdStrike Falcon deployment across 3,000 endpoints, served as Incident Commander on escalated incidents, and built IR playbooks that cut containment from 72 hours to under 6.

Highly proficient in SPL, with query skills that transfer directly to CQL. Experienced supporting NIST 800-53, SOX, and HIPAA evidence requirements across hybrid on-prem and cloud environments. CISSP · CCSP · CISA · AWS CCP.

Information Security Engineer at Sevita (2021-05 – Present)

• Deployed Mimecast across 6,000+ mailboxes, reducing phishing click-through by ~80% and eliminating ~95% of inbound malicious attachments within 90 days.
• Architected Netskope SWG/CASB/DLP to replace legacy proxy infrastructure, providing cloud and SaaS security telemetry and cutting cloud data exfiltration incidents to zero in 12 months.
• Stood up Delinea PAM across 200+ privileged accounts, eliminating shared credentials and producing privileged-access telemetry for monitoring and investigations; achieved NIST 800-53 AC-2 compliance.
• Built HIPAA-aligned DLP policies across Forcepoint, Mimecast, and Netskope; blocked 100% of audited PHI exfiltration attempts with zero compliance findings.
• Led and mentored 2 junior engineers through a 12-month, full-domain security rotation program; both gained independent ownership of tier-1 platforms.
• Provided end-to-end audit support processes for annual HIPAA and SOX assessments related to Privilege Access Management (PAM).

Cybersecurity Engineer at Secretary of the Commonwealth of Massachusetts (2018-08 – 2021-05)

• Owned the enterprise Splunk Enterprise Security platform end to end — onboarded and normalized 50+ log sources across endpoint, identity, network, and application tiers, monitored ingestion health to close visibility gaps, and built 120+ custom correlation searches — achieving full visibility across network, endpoint, and application tiers for the first time.
• Identified and proposed the full replacement of hardware F5 WAFs with Imperva Cloud WAF + load balancers after threat hunting uncovered active attack campaigns against 12 public-facing websites; project delivered in under 6 months, blocking 10,000+ malicious requests per day post-deployment.
• Owned the CrowdStrike Falcon rollout across 3,000 endpoints and led development of incident response playbooks that reduced average containment time from 72 hours to under 6 hours.
• Enriched Splunk ES with Recorded Future threat intelligence feeds, facilitating real-time blocking of IOCs and resulting in the successful eviction of three distinct threat actors within 90 days.
• Designed Zero Trust network segmentation aligned to NIST 800-53 and CIS Controls and participated in firewall change review, reducing lateral-movement risk surface by an estimated 60% based on post-implementation penetration testing.
• Facilitated procurement of eight security products by conducting thorough vendor assessments and negotiating contracts to embed critical security requirements before deployment.
• Engineered runbooks for security operations workflows in Splunk ES and CrowdStrike Falcon, enabling 40% faster SOC onboarding and consistent incident response across a team of 4 engineers.
• Authored technical documentation and incident reports for high-severity SOC escalations, reducing response delays by 30% and improving cross-team alignment.

Security Operations Engineer at Harvard Business School (2016-08 – 2018-08)

• Detected and disrupted a nation-state-aligned Microsoft 365 credential-stuffing campaign targeting 500+ Harvard alumni accounts: built a two-stage Splunk query pipeline to correlate attacking IPs (≥5 accounts targeted) with successful logins, then cross-referenced Microsoft phishing alert data — enabling account lockout and full incident containment within 24 hours.
• Delivered Qualys/Nessus-based vulnerability management program covering 2,500 assets; built automated triage dashboards that cut analyst review time by 40% and drove critical patch SLA compliance from 55% to 92%.
• Automated CrowdStrike alert triage with Python scripts, reducing false-positive analyst load by 35% and freeing ~8 hours/week per analyst for high-fidelity threat hunting.
• Led endpoint AV platform migration for 3,000 workstations with zero production downtime, maintaining full detection coverage throughout the transition.
• Served as Incident Commander for a security incident affecting the HBS Alumni website — ran the response bridge, directed containment and remediation, briefed executives, and led the post-incident review; recognized by IT leadership for leadership, communication, and operational excellence.
• Managed 24x7 intrusion detection operations using Splunk and CrowdStrike for a network of 2,500 endpoints, identifying and escalating high-priority threats to maintain sub-2 hour incident response SLAs over 18 months.
• Deployed Cisco Duo SSO as MFA for HBS employees and created a Splunk dashboard to help the HBS Helpdesk team support employees more effectively.
• Conducted comprehensive risk assessment across internal and external web applications quarterly, identifying and prioritizing vulnerabilities to guide remediation efforts, resulting in a 58% reduction in critical risk findings over 18 months.
• Architected and deployed custom Splunk SIEM correlation rules, reducing mean time to detect (MTTD) critical threats by 45% across 2,500 endpoints.

Security Engineer at Main Line Health (2015-11 – 2016-08)

• Rebuilt the Qualys vulnerability management program and engineered a new patch deployment workflow that compressed the patch cycle from 3 months to 3 weeks — a 75% reduction — while maintaining HIPAA audit compliance.
• Authored incident response procedures that passed external audit review on first submission with zero revision requests.
• Developed and implemented comprehensive threat modeling processes using Microsoft Threat Modeling Tool.
• Applied security principles to architect and enforce a layered defense strategy over 10 months, reducing critical incidents by 35%.
• After reviewing risk management findings, identified major issues in the patch management process for Windows endpoints and servers. Successfully persuaded department managers to implement a strict security patch management process.

Security Monitoring Analyst at BlackRock (2013-05 – 2015-10)

• Tuned Splunk monitoring environment, reducing alert noise by 50% through custom correlation rules and suppression logic, enabling analysts to focus on actionable signals.
• Developed standardized threat investigation runbooks adopted across the SOC, cutting escalation errors by 30% and accelerating analyst certification timelines by 2 weeks.
• Reviewed identity and access activity across 1,500+ endpoints in Splunk, detecting and escalating an average of 25 unauthorized access attempts per month to maintain regulatory compliance and reduce threat dwell time by 40%.
• Created and implemented over 120 custom Splunk and Cisco NetWitness correlation rules, enhancing alert fidelity by 35% and reducing MTTD by 20% for 1,500+ endpoints.
• Ran SIEM monitoring for a regulated asset manager across 1,500+ endpoints, accelerating incident identification by 25% through automated detection logic and real-time KPI dashboards for SOC and leadership reporting.
• Implemented SOAR-style automated playbooks for Splunk alert handling, decreasing manual triage time by 40% and improving policy enforcement consistency.
• Coordinated day-to-day with the managed security service provider (MSSP) on detection escalations and handoffs, reducing cross-team response times by 35%.

M.S. in Information Assurance – Capitol Technology University

B.S. in Computing Technology – Drexel University