Cyber Security Consultant (Hunter & Responder)
Manu Prasadh
I detect, investigate and contain threats, and I write the code that makes detection faster. Twelve years in security operations, with a developer's habit of automating the repeat work.
Security first, built with code
I have spent over twelve years in 24/7 security operations: monitoring, investigating and responding to incidents, then turning each lesson into better detection. My background in software lets me write my own parsers, analysis tools and automation instead of waiting for a vendor feature.
I work comfortably across SIEM, SOAR, endpoint, network and cloud security, and I like explaining findings to engineers and to leadership in plain terms.
Cyber security expertise
This is the core of my work: from the first alert to the post-incident review, and the detection engineering in between.
Security operations and incident response
Round-the-clock monitoring, triage, containment, eradication and recovery, run to SLA with playbooks and SOPs that analysts can follow under pressure.
Detection engineering
SIEM correlation rules, custom log parsers and SOAR playbooks aligned to MITRE ATT&CK, tuned continuously to cut false positives.
Threat hunting and intelligence
Collecting indicators of compromise, building detections from them, and hunting for stealthy intrusions and cloud attack patterns.
Vulnerability assessment and testing
Web application and network assessments, penetration testing, malware analysis, and checking that patching and remediation actually happen.
Cloud and endpoint security
Monitoring on-premises and cloud infrastructure for misconfigurations, data loss and performance gaps that would blind detection.
Governance and awareness
Risk assessments, audits and policy work aligned to ISO/IEC 27001, NESA and PCI DSS, plus awareness programs and SOC readiness drills.
Email and web application defense
Investigating phishing and malicious email, and responding to web attacks such as SQL injection, malicious uploads and port scans.
Mentoring and evaluation
Training analysts and engineers, and testing new security products through proofs of concept before recommending them.
Toolkit
Platforms I have worked hands-on with, grouped by job.
- SIEM
- ArcSightSplunkQRadarAzure Sentinel
- SOAR
- Cortex XSOARFortiSOAR
- Endpoint
- MS DefenderSymantecMcAfee
- Vulnerability assessment
- NessusRapid7
- Data exfiltration
- ForcepointFidelisMcAfee DLP
- Host IDS/IPS
- Cisco AMPSymantec Data Center Security
- Network detection
- CorelightExtraHop
- Web app firewall
- F5 ASMRadware AppWall
- Email security
- Microsoft 365Cisco ESASymantec MG
- DDoS protection
- Arbor APSLancope StealthWatch
- Patch management
- Symantec Altiris
- Databases
- OracleMS SQL ServerMS AccessMySQL
- Analysis and recon
- Active DirectoryELK StackNmapGhidraNiktoFLARE-VM
Programming
Languages I use to build parsers, analysis tools and web work.
Certifications
| 2022-12 | SC-100Microsoft Cybersecurity Architect Expert |
| 2022-08 | SC-200Microsoft Security Operations Analyst |
| 2021-08 | AZ-500Microsoft Azure Security Technologies |
| 2021-03 | NSE 1 and 2Fortinet Network Security Expert |
| 2020-11 | MS-500Microsoft 365 Security Administration |
| 2019-02 | CEH v10Certified Ethical Hacker |
Career progression
- Security Operations Centre Analyst
Log analysis across firewalls, IDS and host sensors; alert investigation; KPI reporting.
- SOC Specialist and SIEM Administrator
Custom parsers, penetration testing, malware analysis and threat intelligence.
- Senior Security Operations and Incident Response Specialist
End-to-end incident response, SIEM and SOAR engineering, and mentoring analysts.
- Senior Cyber Security Analyst, SOC and Engineering
Advanced investigation, threat hunting and detection engineering across network and cloud.
Education
| 2016 to 2018 | Master of Computer Applications |
| 2012 to 2015 | Bachelor of Computer Applications |
Recognition
- Star of the Month, On the Spot and Star Team awards for excellent performance.
- Built custom parsers for the event logs of many different security tools.
- Developed an analysis tool and several projects that speed up security operations.
Languages spoken
English, Tamil and Malayalam
Let's talk security
Based in Abu Dhabi, UAE. Open to conversations about security operations, detection engineering and development.