Kunal Shah

Security architect and IT security risk and compliance professional with 14+ years spanning software engineering, SIEM/EDR/FIM product development, security architecture, and IT security governance. Deep expertise in NIST 800-53 and HIPAA/HITECH risk assessments, vulnerability management, medical device/IoMT security, AI governance and PHI risk assessment, SIEM technologies, incident response, and cloud security (AWS, Azure). Proven record of designing scalable security architectures for enterprises and MSP/MSSPs, leading products from requirements through production release, and translating technical risk into practical recommendations for stakeholders.

Hands-on software background (C++, C#, Python, SQL) that supports evaluating system design and risk.

IT Security Specialist - Teknosys Inc (Contract to NC DHHS) - Morrisville, NC

(2025-06)

• Conduct NIST SP 800-53 Rev. 5 risk assessments and security reviews for State-hosted, cloud, and vendor-managed apps; manage PTAs, VRARs, SOC 2 Type II reviews, SSPs, DRPs, and penetration test results.
• Support security governance and continuous monitoring for 50+ DSOHF applications, including access control reviews, remediation tracking, and BC/DR/COOP requirements.
• Designed and implemented a medical device/IoMT vulnerability management program using ORDR, delivering continuous monitoring across 13 hospital facilities; coordinate scanning and remediation via Qualys, Tenable, Veracode, and Tanium.
• Authored the department-wide Medical Device Policy and a division-wide IoMT Management Procedure, establishing governance standards for medical device security across NC DHHS.
• Led security assessments of AI/ML modules and PHI safeguards, reviewed contracts/SOWs/BAAs for security requirements, and coordinated incident response and access-control reviews via ServiceNow with PSO.

Security Architect - EventTracker Security LLC - Columbia, MD

(2019-01 - 2024-07)

Products: EventTracker SIEM, Change Audit (FIM), EventTracker EDR; Deep Instinct endpoint security

• Conducted BIA and risk assessments supporting BC/DR planning; reviewed SSPs and access control strategies, and ensured compliance with HIPAA, HITECH, PCI-DSS, and NIST 800-53.
• Led incident response investigations and vulnerability assessments across IT infrastructure and EHR systems; developed incident response playbooks and security documentation; developed machine learning rules and alerts and conducted post-event analyses of client environments.
• Oversaw multiple MSPs/MSSPs with roughly 100,000 assets integrated into SIEM; onboarded 70+ enterprise customers and 25 MSSPs end to end — scoping the environment, configuring collectors, deploying sensors across operating systems, integrating assets, tuning performance, writing runbooks, and transitioning to the SOC for monitoring.
• Led a 1+ year project with a major MSP serving Healthcare, Banking, and Retail clients across three states: architected infrastructure with 8 collectors and 2 master collectors, designed a scalable, replicable MSSP deployment architecture, and implemented SOC use cases for customers in a multi-tenant environment; architected scalable cross-cluster Elasticsearch infrastructure.
• Designed a hybrid SIEM solution for a large enterprise across on-premises data centers, AWS (Lambda, CloudTrail), and Azure (Function Apps, Event Hubs) to monitor all assets across the infrastructure.
• Contributed to a successful proof of concept with a major ISP monitoring 6,000+ Fortigate firewalls: tuned system performance, produced reports for actionable insight, built custom alerts for threat detection, and helped generate PCI DSS compliance reports.
• Managed 25,000+ endpoints with Deep Instinct; trained the SOC team on the product and served as liaison and primary technical contact between Netsurion and Deep Instinct.
• Advised clients on configuring compliance reports (PCI-DSS, HIPAA) in EventTracker SIEM and designed, built, tested, and implemented security systems, recommending enhancements based on assessments of current security measures.
• Delivered product presentations and demos (SIEM, Change Audit/FIM, EDR, Deep Instinct) to prospects, contributing to sales, and advised the business on technical solutions and their value.
• Acted as customer advocate, escalating customer requests to engineering and moving customer issues from critical "red" to satisfactory "green" resolution.

Tech Lead, Software Dev - Netsurion Technologies Pvt. Ltd. - Bangalore, India

(2017-01 - 2019-01)

• Led end-to-end design and development of EventTracker EDR from requirements through production release across all stages of the secure systems development lifecycle — earning an AAA rating from SE-Labs.
• Integrated endpoint detection and response with SIEM and drove R&D to enhance the product's ability to monitor system activity and identify malicious actors.
• Coached and trained clients and in-house security analysts on EventTracker EDR.
• Led requirements gathering, analysis, implementation, and system study with stakeholders; managed the workflow of product changes across cross-functional teams and led the offshore development team.
• Developed and maintained project schedules, work plans, and KPI reporting for project management teams; monitored project progress and provided problem analysis and corrective action.
• Performed onsite requirement gathering, knowledge transfer, integration, and feature testing.

Tech Lead, Software Dev (EventTracker Engine Team) - Prism Networks Pvt. Ltd. - Bangalore, India

(2012-02 - 2017-01)

Products: EventTracker SIEM and Change Audit (File Integrity Monitoring)

• Scaled EventTracker SIEM syslog throughput from 300 to 3,000 events/sec via multithreading; served as product owner for EventTracker Change Audit (FIM).
• Led analysis, design, development, testing, and implementation of new functionality and upgrades as Analyst/Developer, working with stakeholders on requirements, analysis, and system study.
• Led design and development of the Data Transfer Service.
• Mentored developers and participated in code reviews; wrote unit and system test cases for the entire application after analyzing scenarios, and performed the testing.
• Debugged high-severity defects, performed log and dump analysis, and worked with operations to resolve defects and ensure quality of modified or new software.
• Provided technical support and leadership on complex problems and hard-to-reproduce bugs (VPN, remote control); created test data and mapped interfaces while leading a team of technical professionals.
• Performed onsite requirement gathering, knowledge transfer, integration, and feature testing.

M.S. - Cybersecurity and Information Assurance - Western Governors University (2024-03)

B.S. - Cybersecurity and Information Assurance - Western Governors University (2022-06)

BCA (Bachelor's in Computer Applications) - Gujarat University (2010-04)