Santhosh Kumar

DFIR analyst and security engineer specializing in incident investigations, digital forensics, email forensics, and endpoint security engineering within critical infrastructure environments. Skilled in enabling forensic readiness on endpoints, validating detection signals, and aligning engineering controls with incident response workflows. Adept at working within audit-driven and compliance-oriented settings requiring structured reporting and procedural accuracy.

Security Analyst (L2) and Security Engineer at NSE – National Stock Exchange of India (2024-07 – Present)

• Performed incident investigations for security events affecting critical infrastructure, supporting containment, eradication, and recovery activities.
• Conducted host-based digital forensics, including artifact acquisition, persistence analysis, timeline reconstruction, and root-cause determination.
• Led email forensics investigations for phishing, BEC, and malware campaigns through header analysis, IOC extraction, URL and attachment detonation, and impact scoping.
• Engineered and tuned EDR detections by validating alerts, refining hunting logic, and reducing false positives through behavioural analysis with respect to MITRE ATT&CK framework
• Deployed and maintained endpoint configuration policies to support detection, response, and forensic readiness across critical systems and to reduce attack surface of 9000+ endpoints.
• Engineered and tuned EDR detections across multi-tenant environment
• Aligned endpoint security configurations with incident response and detection requirements to improve containment effectiveness and signal quality.
• Implemented endpoint security controls to enforce device posture, compliance policies, and operational access requirements.
• Create and implement automated response playbooks, reducing manual triage effort by ~20–30%
• Led 12+ annual purple team exercises for tenant-specific EDR detection and prevention requirements, validating control efficacy against adversary TTPs and driving remediation of detection gaps through tuning and policy refinement.
• Partnered with OEM security teams to design and operationalize tenant-specific EDR detection and prevention controls.
• Conducted endpoint compromise and security posture assessments, identifying breach indicators, hidden persistence, attack surface weaknesses, and control gaps, and driving remediation through targeted hardening and detection improvements.

Digital Forensics Examiner Intern at COEDF – Digital Forensics Laboratory (2024-01 – 2024-03)

• Supported 25+ forensic casework involving computer and mobile evidence for federal investigations.
• Performed acquisition, artifact examination, timeline reconstruction, and case documentation.
• Executed OS-level acquisition and artifact extraction for Windows and Android.
• Maintained proper evidence handling and reporting procedures.

Master of Science in Digital Forensics & Information Security – National Forensic Sciences University (NFSU) (2022 – 2024)

Bachelor of Science in Information Security & Digital Forensics – Karunya Institute of Technology & Sciences (2019 – 2022)