Key Responsibilities & Actions:
Threat Intelligence & IOC/IOA Management: I ingest and operationalize alerts from RBI regulatory bodies (CERT-In, NCIIPC, FSISAC) and third-party subscriptions (RSA, VISA, Wipro). I translate raw IOCs (IPs, Hashes, Domains, URL, CVE ID, File name & file path, Email ID & Email Domain) into actionable blocks across Firewalls, IPS, Proxy, EDR, Email gateway and finally foot printing for this IOC & IOA.
Brand Impersonation & Takedown (Cloud SEK, iZoologic): I hunt for and respond to digital brand abuse, including fake Facebook/Instagram profiles, phishing URLs, fraudulent mobile apps (APKs), and rogue websites. I coordinate with Marketing for validation and with Threat Intel partners for global takedown.
Data Leak Response (Scribd, GitHub, Dark Web): When PII, financial statements, or internal documents are exposed on public platforms (like Scribd) or code repositories (GitHub), I lead the containment effort, engage legal team like CFMU & GBO teams, and manage takedown requests to prevent financial fraud.
Credential Breach & Malware Stealer Response: I analyze stealer logs and combo lists from Telegram/Dark Web forums. I identify impacted users (employees & customers), force password resets, terminate active sessions, initiate AV scans, check for AD-alert, and coordinate with the CFMU (Fraud) team to check for unauthorized transactions.
Vulnerability & Botnet Management: I assess high-risk advisories (e.g., NetScaler ADC, FortiClient EMS) and botnet/malware infections on internal assets. I work with VAPT and system owners to validate exposure and remediate misconfigurations (e.g., exposed SSH ports).
Email & Phishing Defense: I analyze ESA anti-spam reports and phishing campaigns, extracting malicious URLs, hashes, and sender domains to block on Email Gateways and Web Proxies.
Cross-Functional Orchestration: I act as the bridge between the SOC (for historical footprinting), Network Team (Firewall blocks), Proxy Team (URL filtering), AV Team (Hash blocking), and Application Owners (password resets).
Impact:
Reduced threat actor dwell time by operationalizing intel within hours, prevented financial fraud by takedown of malicious APKs/phishing sites, and ensured regulatory compliance by responding to CERT-In/NCIIPC directives.
