Jayesh Choudhary
Lead Security Engineer
Security engineer with 5+ years of hands-on experience across detection engineering, insider threat management, cloud incident response, and DLP implementation. Building detection-as-code pipelines, hunting adversaries across cloud and enterprise environments, and translating threat intelligence into measurable security outcomes.
Payatu
—Lead Security Engineer- ›Built end-to-end threat intelligence automation aggregating 50+ cybersecurity RSS sources with auto-categorization, reducing manual triage by 70–80%
- ›Automated IOC enrichment (IPs, domains, hashes) via AlienVault OTX and VirusTotal with concurrent lookups and confidence scoring for faster SOC/IR investigations
- ›Delivered Microsoft Purview DLP across ~400 endpoints and 15+ data sources — 10+ custom SITs, trainable classifiers, 25+ DLP policies — improving classification accuracy ~40%
- ›Deployed and integrated Microsoft Defender, Intune, and Wazuh with 30+ custom security policies, achieving 95% endpoint compliance
- ›Built 30+ MITRE ATT&CK-mapped threat-hunting queries in Microsoft Sentinel, improving detection coverage ~30%
- ›Led incident response for active breach scenarios, reducing MTTC ~35% and driving 15+ prioritized remediation actions
- ›Designed full incident management policy and response program — severity models, escalation matrices, playbooks — improving SOC readiness ~40%
- ›Implemented Microsoft Teams → Azure Logic Apps → SharePoint Excel workflows eliminating manual security advisory entry
Coralogix
—Cloud Incident Response- ›Reduced MTTD by 40% through cloud-native detections across CloudTrail, IAM, and VPC telemetry for privilege escalation and data exfiltration scenarios
- ›Decreased MTTR by 35% with automated containment playbooks — disabled compromised IAM identities and isolated workloads within minutes
- ›Led end-to-end response for high-severity cloud incidents including IAM compromise and misconfigured storage exposure
- ›Developed 30+ cloud detection use cases mapped to MITRE ATT&CK (Cloud), reducing false positives by 30% via contextual enrichment and behavioral baselining
- ›Enforced least-privilege IAM and guardrails, improving overall cloud security posture by 25%
Bank of America
—Insider Threat Management Officer- ›Implemented detection alerts for data exfiltration via alternate protocols (DNS/HTTPS tunneling)
- ›Created detection/response alerts for password spray attacks, Windows tampering, steganography tool usage, and cryptographic site monitoring
- ›Leveraged threat intelligence feeds to proactively identify insider threats, reducing data exfiltration incidents by 25%
- ›Contributed to insider threat playbooks incorporating threat intelligence insights, reducing IR times by 30%
- ›Applied external and internal threat intelligence to enhance monitoring rules — 15% reduction in false positives
- ›Deployed playbooks and runbooks for incident triage, reducing time by 30%
Bank of America
—Cyber Security Analyst- ›Monitored for malicious incidents and managed threats by blocking malicious IP/domains before user access — enabling proactive risk mitigation
- ›Identified and banned access to high-risk domains across 7,000+ users to prevent data exfiltration
Detection & Response
—Analyst — Detection and Response- ›Designed and tuned EDM- and regex-based DLP detection policies to improve identification of sensitive data patterns
- ›Conducted periodic DLP policy reviews and user guidance to improve adherence and reduce policy noise
- ›Refined detection logic to reduce false positives and improve analyst triage efficiency
CRMNext
—Graduate Engineer Trainee- ›Implemented and managed CRM systems, improving data accuracy and achieving 15% increase in customer satisfaction
- ›Led CRM system upgrades and migrations with minimal business disruption
SWIFT Payment Fraud via BEC — Incident Response & Ground-Up SOC Build
BreachForums Data Exposure — Multi-Vector Compromise & SilverFox C2
Enterprise CTI Platform & Brand Monitoring — Architecture & Automation
Multi-SIEM Detection Engineering Program — Sigma/YARA + Automated SOAR Response
Advanced Malware Forensics — Custom Implant Reverse Engineering & C2 Takedown
Active Exploitation of Financial API — MSRPC Abuse & Compensating Controls
Cross-Cloud Lateral Movement — Federated Identity Abuse (Azure AD → AWS)
Security Program Architecture for Regulated Fintech — Board-Level Strategy & Execution
Frameworks & Methodology
Security Domains
Security Tools
Malware Analysis
Cloud & Infrastructure
Languages & Platforms
Data Protection & Privacy
- ▸Data Classification & Handling Policy
- ▸Data Retention & Disposal Standard
- ▸GDPR Data Subject Rights Procedure
- ▸Data Protection Impact Assessment (DPIA) Process
- ▸Cross-Border Data Transfer Safeguards
Incident Response & Management
- ▸Information Security Incident Response Policy
- ▸Severity Classification & Escalation Matrix
- ▸Breach Notification Procedure (72-hour GDPR alignment)
- ▸Incident Response Playbooks & Runbooks
- ▸Post-Incident Review & Lessons Learned Process
Access & Identity Governance
- ▸Identity & Access Management Policy
- ▸Privileged Access Management Standard
- ▸Least-Privilege IAM Enforcement (Cloud)
- ▸Access Recertification Procedure
Endpoint & Cloud Security
- ▸Endpoint Security Compliance Policy
- ▸Cloud Security Posture Management Standard
- ▸Microsoft Defender / Intune / Wazuh Policy Set (30+ policies)
- ▸Continuous Monitoring & Drift Detection
Tooling: Microsoft Purview · Defender · Intune · Wazuh · Azure Logic Apps · Custom Python automation
⟩FreeIntelHub — Open Source CTI Platform
Real-time cyber threat intelligence platform with RAG-based LLM intelligence generation, PostgreSQL + Neo4j + Redis storage, Kafka ingestion, and semantic IOC search via Pinecone. Full-stack system evolved from a Node.js/Express app.
⟩Open Source Threat Intelligence Platform
Standalone CTI platform built on OpenCTI and Docker. Deployed Docker Swarm with Portainer, added TRAEFIK reverse proxy, and integrated MISP for threat feed aggregation.
⟩Threat Intelligence Dashboard
Custom dashboard integrating STIX/TAXII data formats with MITRE ATT&CK for real-time threat hunting. Automated ingestion and normalization of feeds from multiple open-source sources, improving detection accuracy by 25%.
⟩Homelab — Detection & Monitoring
Full detection lab: pfSense firewall for network segmentation, Security Onion as IDS/monitoring/log management, Kali Linux attack machine, Windows Domain Controller, and Splunk for log aggregation.
⟩100 Days of YARA
Public GitHub repository documenting a structured 100-day deep dive into YARA rule writing for malware detection and threat hunting.
⟩Daily Does of Cybersecurity News
Active cybersecurity news and analysis blog covering threat landscape developments, tooling, and security practices.
CISSP
Certified Information Systems Security Professional
ISC²
✓ VERIFIEDCISM
Certified Information Security Manager
ISACA
✓ VERIFIEDCISA
Certified Information Systems Auditor
ISACA
✓ VERIFIEDCASP+
CompTIA Advanced Security Practitioner
CompTIA
✓ VERIFIEDPenTest+
CompTIA Penetration Testing
CompTIA
✓ VERIFIEDCySA+
CompTIA Cybersecurity Analyst
CompTIA
✓ VERIFIEDSecurity+
CompTIA Security+
CompTIA
✓ VERIFIEDCFR-410
CyberSec First Responder
CertNexus
✓ VERIFIEDSC-100
Cybersecurity Architect Expert
Microsoft
✓ VERIFIEDSC-300
Identity & Access Administrator
Microsoft
✓ VERIFIEDSC-200
Security Operations Analyst
Microsoft
✓ VERIFIEDAZ-500
Azure Security Engineer Associate
Microsoft
✓ VERIFIEDSC-900
Security, Compliance & Identity Fundamentals
Microsoft
✓ VERIFIEDCCSK v4 & v5
Certificate of Cloud Security Knowledge
CSA
✓ VERIFIEDGoogle IT Professional
Google Career Certificate
CRISC
Certified in Risk and Information Systems Control
ISACA
Enterprise IT risk identification, assessment, response, and monitoring. Validates ability to design and implement IS controls aligned to business objectives.
ISSMP
Information Systems Security Management Professional
ISC²
CISSP concentration in security program leadership — covers project management, security operations, business continuity, law and ethics, and compliance.
ISSAP
Information Systems Security Architecture Professional
ISC²
CISSP concentration in security architecture — access control, cryptography, network/application security architecture, and technology-related BCP/DRP.
ISSEP
Information Systems Security Engineering Professional
ISC²
CISSP concentration in security engineering — systems engineering principles applied to secure system design, including NIST RMF and systems security lifecycle.
All three ISS concentrations require active CISSP in good standing.