Sanjana Reddy

Senior Cyber Security Engineer with 7+ years of experience securing multi-cloud environments across government, financial, retail, and enterprise organizations, with strong expertise in Zero Trust Network Access (ZTNA), cloud security, and security operations. Proven experience designing and implementing Zscaler ZIA/ZPA, identity-aware access controls, least-privilege policies, and NIST 800-207 Zero Trust Architecture. Hands-on expertise with GCP, AWS, and Azure security services, IAM/Okta, SIEM platforms (Splunk, Microsoft Sentinel, QRadar), EDR/XDR, and cloud security posture management.

Skilled in security automation using Python, Terraform, CloudFormation, ARM templates, REST APIs, and XSOAR, improving operational efficiency and compliance. Strong background in incident response, threat hunting, DLP, endpoint security, network security, vulnerability management, and FedRAMP/NIST compliance. Adept at implementing secure cloud architectures, analyzing complex security risks, and delivering strategic security solutions that strengthen enterprise cyber resilience.

Security Operations Center (SOC) Analyst at Virginia Information Technologies Agency (VITA) (2021-12 – Present)

• Contained ransomware, phishing, and credential theft by executing incident response with CrowdStrike Falcon, Microsoft Defender for Endpoint/O365 Defender, and Microsoft Sentinel, reducing mean-time-to-respond (MTTR) by 35% across state agencies.
• Minimized risk exposure by conducting vulnerability scans with Tenable Nessus/Tenable.io and driving remediation through Ivanti Security Controls, closing 95% of high-risk findings within SLA windows.
• Monitored, investigated, and responded to advanced cyber threats using Palo Alto Cortex XDR, reducing incident response times through automated detection and remediation workflows.
• Created automated response playbooks for phishing, malware, ransomware, insider threats, and account compromise incidents, improving analyst efficiency and response accuracy.
• Performed cloud security posture assessments, identifying security gaps related to IAM, network segmentation, encryption, and logging configurations.
• Automated ZTNA policy validation and access governance using Python and REST APIs, improving compliance and reducing manual administration.
• Implemented IAM policies and organization-level security controls across GCP environments.
• Performed security assessments for Google Cloud Platform (GCP) resources including Compute Engine, Cloud Storage, Cloud IAM, Cloud Logging, and VPC.
• Designed and implemented Zero Trust Network Access (ZTNA) policies to replace legacy VPN access, enforcing identity-aware authentication and least privilege connectivity across cloud workloads.
• Supported incident response investigations by analyzing security findings, cloud logs, threat intelligence, and forensic artifacts from AWS environments.
• Administered Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) policies for secure user connectivity.
• Configured secure application access using ZTNA principles aligned with NIST 800-207, improving secure remote access while reducing attack surface.
• Performed cloud security assessments of AWS services including EC2, S3, RDS, Lambda, EKS, ECS, IAM, and VPC to identify and mitigate security risks.
• Collaborated with IAM teams to integrate identity-aware access controls with cloud resources and enterprise authentication systems.
• Managed firewall configurations, VPN access, network segmentation, and secure remote connectivity solution.
• Strengthened network and cloud visibility by integrating logs from Blue Coat Proxy, Cisco ASA, Palo Alto, Check Point, Fortinet, Wireshark, TCPDump, SolarWinds, EnCase, FTK Imager, Autopsy, AWS Security, and Azure Security, ensuring 100% coverage across endpoint, network, and cloud assets.
• Increased detection accuracy by fine-tuning Splunk, IBM QRadar, Microsoft Sentinel, SOAR platforms, UEBA, and threat intelligence feeds, correlating data from EDR, IDS/IPS, and NDR, which improved identification of insider threats and brute-force attempts by 40%.
• Participated in security documentation and evidence collection for FedRAMP audits.
• Configured enterprise Data Loss Prevention (DLP) policies to monitor sensitive information across email, endpoints, and cloud storage.
• Supported cloud environments operating under FedRAMP Moderate security requirements.
• Conducted security reviews of CI/CD pipelines and DevSecOps processes, ensuring security controls were embedded throughout the software development lifecycle.
• Collaborated with Security Operations Center (SOC) Incident Response, Threat Intelligence, and IT teams to coordinate effective responses to high-severity cyber incidents.
• Created custom automation scripts in Python and REST API integrations within XSOAR to enhance security orchestration and reduce manual analyst workload.
• Automated vulnerability scanning and reporting workflows using Python, PowerShell, and REST APIs, improving remediation efficiency and audit readiness.

Cyber Security Engineer at World Informatics Cyber Security (2021-05 – 2021-10)

• Delivered actionable threat intelligence by analyzing IBM X-Force, ThreatConnect, and STIX/TAXII feeds, enabling early detection of APT campaigns and reducing exposure to sector-specific threats by 30%.
• Applied Cyber Kill Chain and MITRE ATT&CK frameworks to correlate adversary TTPs across IDS/IPS, firewall, and endpoint logs (CrowdStrike, Microsoft Defender), improving attribution accuracy and guiding countermeasures that stopped multiple targeted intrusion attempts.
• Collaborated with development, DevOps, and infrastructure teams to remediate vulnerabilities and integrate security controls into CI/CD pipelines.
• Validated Azure infrastructure compliance using ARM policies.
• Integrated ARM deployments into CI/CD pipelines.
• Implemented secure infrastructure provisioning through ARM templates.
• Performed security validation of APIs, microservices, and serverless applications deployed in AWS environments.
• Enhanced incident response with IBM QRadar, Azure Sentinel, and ThreatConnect SIEMs, reducing dwell time of confirmed intrusions by 40% through faster log correlation and containment actions.
• Developed automated vulnerability scanning and reporting workflows using Python, AWS Lambda, and security orchestration tools.
• Implemented Infrastructure as Code (IaC) security scanning for Terraform, CloudFormation, and Kubernetes manifests to identify misconfigurations before deployment.
• Conducted vulnerability assessments with Rapid7 Nexpose and Nessus, validating controls against NIST SP 800-137, and collaborating with IT/network teams to remediate critical CVEs within 72 hours, while using EnCase for forensic preservation in high-severity cases.

Vulnerability Analyst at Wawa (2020-06 – 2020-12)

• Reduced enterprise risk by managing vulnerabilities with Rapid7 Nexpose/InsightVM, validating findings against NVD, US-CERT, and CIS Benchmarks, and ensuring 98% remediation of critical issues within PCI-DSS and CIS compliance standards.
• Strengthened access and endpoint security by administering Microsoft Defender XDR (Endpoint, Identity, O365) integrated with Microsoft Sentinel, enforcing Azure AD Conditional Access, Okta SSO/MFA, and achieving full compliance for 5,000+ endpoints via Intune and Kandji.
• Improved detection by tuning Mimecast, IDS/IPS, and Arctic Wolf MDR, cutting phishing false positives by 45% and reducing incident triage times by 50%.
• Hardened cloud environments with AWS Security (CloudTrail, S3 encryption, IAM, KMS, Lambda automation), while conducting risk assessments via SAI Digital Manager 360 (Modulo) to support RMF/ATO approvals, accelerating certification timelines by 25%.

Digital Product associate / Cyber Intern at Green America org (2018-01 – 2019-10)

• Implemented security standards from NIST SP 800-53/53A, PCI-DSS, ISO 27001, and CVSS, converting them into firewall rules (ACLs, NAT, VPN IPsec/SSL) and SIEM policies, improving compliance adherence by 30% across systems.
• Improved detection capability by administering Splunk Enterprise and monitoring alerts via Splunk, SolarWinds, and LogRhythm, automating scans with Splunk Phantom for QualysGuard, Qualys WAS, and Nessus findings, reducing manual workload by 40%.
• Strengthened network security by migrating Cisco ASA to Palo Alto NGFW and Cisco to CheckPoint VSX firewalls, applying App-ID, Content-ID, User-ID policies, and administering Blue Coat ProxySG, reducing unauthorized access attempts by 35%.
• Enhanced endpoint defense with Symantec Endpoint Protection, Bit9, Snort, Wireshark, TCPDump, SSL Dump, and Microsoft Network Monitor, while streamlining compliance documentation (SSPs, POA&Ms, risk assessments) and incident/change workflows via ServiceNow.

Master's in Cyber Security – Marymount University (2021)

Bachelor's in Information Technology – Marymount University (2019)