Pankaj Kumar

Experienced IT and Cybersecurity professional with a strong background in AWS Cloud Security, GRC and vulnerability management, network design, and security principles. Proficient in leveraging various cloud platforms (Azure, AWS) and Infrastructure as Code (IaC) tools including Terraform, Ansible, Jenkins, and GitHub. Hands-on expertise with a wide array of cyber security testing and monitoring tools such as SIEM, Metasploit, NMAP, Burp Suite, Nessus, Qualys, and Splunk.

Skilled in formal system testing, project management, identifying vulnerabilities, and preparing financial reports.

Infrastructure & Enterprise Engineer III - Expedia Online Travel service India Pvt Ltd - India

(2019-07)

• Acted as the SOC L3 escalation point, orchestrating complex incident response workflows and threat hunting operations across a hybrid infrastructure using Splunk ES and Microsoft Sentinel, Crowdstrike Falcon, Qradar and Exabeam.
• Spearheaded the administration and health monitoring of IBM QRadar and Exabeam, ensuring 99.9% uptime for critical security logging infrastructure.
• Engineered custom correlation rules in QRadar using AQL and built behavioral models in Exabeam to identify advanced persistent threats (APTs) and insider risks.
• Successfully onboarded 50+ disparate log sources (firewalls, cloud environments, EDR) into QRadar and created custom parsers utilizing the DSM Editor.
• Tuned Exabeam Advanced Analytics risk scoring timelines, significantly reducing false positives and improving SOC analyst triage efficiency by 35%.
• Correlated multi-stage attack paths by combining QRadar offenses with Exabeam Smart Timelines to accelerate incident investigation and containment.
• Collaborated with threat intelligence teams to translate MITRE ATT&CK frameworks into actionable detection logic across both SIEM platforms.
• Engineered advanced SIEM correlation rules, custom KQL/SPL search queries, and automated SOAR playbooks in Microsoft Sentinel and Splunk.
• Reduced false-positive security alerts by 20-30%, allowing the SOC team to focus on critical, high-fidelity security incidents.
• Leveraged Splunk and Microsoft Sentinel logging architectures to build continuous compliance reporting pipelines for infrastructure security tracking.
• Provided bulletproof audit trails that secured 100% compliance pass rates for SOC 1, SOC 2, ISO 27001, NIST, and GDPR assessments.
• Spearheaded a complex, zero-downtime data center migration moving legacy on-premises infrastructure to a hybrid multi-cloud architecture (Azure/AWS/OCI).
• Reduced physical data center footprints by 40% and enhanced application availability via optimized cloud resource deployment.
• Architected an enterprise-wide network security upgrade, deploying advanced Endpoint Detection & Response (EDR) and Extended Detection & Response (XDR) platforms.
• Reduced security incident response times by 20% and blocked 30% of advanced threat vectors across hybrid endpoints.
• Established and executed a unified IT governance framework to prepare the global infrastructure for strict regulatory reviews.
• Achieved flawless, zero-non-compliance certifications across SOC 1, SOC 2, ISO 27001, NIST, and GDPR frameworks.
• Engineered a comprehensive, automated enterprise backup strategy and structured BCP/DR simulations for core business-critical workloads.
• Reduced Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO) by 20%, securing continuous operations during testing scenarios.
• Oversaw the security optimization and governance cleanup of the enterprise Microsoft 365 environment.
• Improved the organization's Microsoft Secure Score by 30% and eliminated high-risk access privileges.
• Conducted continuous internal IT security audits to align local branch operations with global security compliance mandates.
• Successfully identified and remediated 200+ critical vulnerabilities prior to external corporate evaluations.
• Leverages AI and GenAI tools to automate complex application portfolio analysis and accelerate data-driven scenario planning, transforming reactive architecture functions into proactive strategic assets.
• Drives organizational efficiency by implementing AI for predictive risk management, intelligent documentation, and automated data curation, ensuring resilient, optimized, and compliant enterprise architecture.
• Led the incident response efforts for a suspected data breach within an AWS S3 bucket, performing rapid digital forensics to determine the attack vector, contain the spread, and recover critical evidence for a post-incident review.
• Orchestrated the forensic investigation of a compromised Azure VM, analyzing disk images and system logs to confirm the scope of the intrusion and developing remediation playbooks to prevent future similar incidents.
• Authored comprehensive security policy documentation and incident response runbooks, improving the security team's average incident response time (MTTR) by 25%.
• Presented complex cloud security risks and remediation strategies to non-technical executive leadership, translating technical findings into clear business impact reports that secured budget approval for new security tools.
• Developed and executed a unified multi-cloud security strategy across AWS and Azure environments, establishing consistent security baselines and control enforcement, resulting in streamlined compliance reporting for both platforms.
• Architected secure data migration pathways between AWS S3 and Azure Blob storage using cross-cloud security policies, ensuring encryption standards and data leak prevention controls were universally applied.
• Orchestrated the monthly, quarterly, and half-yearly review cycles for AWS and Azure security infrastructure, identifying key vulnerabilities and tracking remediation actions.
• Developed and enforced comprehensive cloud security policies and standards aligned with industry frameworks (e.g., CIS Benchmarks, NIST, ISO 27001), improving organizational compliance posture by 15%.
• Prepared and delivered monthly reports on cloud security compliance posture to senior leadership, providing clear metrics and actionable improvement plans.
• Conducted regular threat modeling, risk assessments, and vulnerability management activities across multi-cloud environments, proactively mitigating potential security exposures.
• Administered and managed Cloud Security Posture Management (CSPM) tools (e.g., Wiz, Prisma Cloud, Microsoft Defender for Cloud), optimizing configurations for maximum coverage.
• Monitored and responded to 100+ weekly alerts from AWS Security Hub and Azure Security Center, ensuring adherence to internal MSIL security policies and checklists.
• Continuously monitored cloud environments for security alerts, taking necessary remediation actions and successfully reducing mean time to detect (MTTD) by 20%.
• Designed and implemented secure cloud architectures for critical Azure and AWS environments, integrating high availability, data protection, and data leak prevention controls.
• Implemented and managed core security controls, including AWS IAM, Azure RBAC, KMS encryption services, and WAF configurations, to harden cloud infrastructure.
• Identified and recommended security improvements aligned with cloud security guidelines, successfully driving the implementation of new controls to meet minimum security baselines.
• Integrated container security best practices into the CI/CD pipeline, utilizing Kubernetes network policies and Docker image scanning to automatically block deployment of vulnerable images, reducing production risks by 35%.
• Implemented specialized monitoring and threat detection for Kubernetes clusters, ensuring runtime adherence to security policies and isolating non-compliant pods during active operations.
• Expert in identifying, exploiting, and documenting vulnerabilities through comprehensive application and infrastructure penetration testing.
• Proven success in developing custom tooling for offensive operations and facilitating workshops with Blue Teams to build Purple Teaming use cases and validate detection capabilities.
• Committed to enhancing organizational resilience through proactive security posture improvement and effective stakeholder reporting.
• Administer AWS infrastructure including compute, network, and storage resources.
• Implement and maintain security measures to protect cloud environments from cyber threats, unauthorized access, and data breaches.
• Configure and manage security controls, monitor suspicious activity, conduct vulnerability assessments, and respond to security incidents.
• Ensure compliance with regulations and review/update security policies to reflect the latest threats.
• Utilize SIEM, EDR, UEBA, Cyber threat hunting, and Threat intelligence tools, including the MITRE ATT&CK® framework.
• Lead problem resolution process to root cause, identifying and fixing broken processes in the infrastructure environment.
• Manage patching across various infrastructure services like OS and AWS services.
• Work with Service Now for Change Management, CMDB.