Uma Shukla

Led incident response efforts, providing guidance on fraud, eDiscovery, threat hunting, and major incident management to business units across the organization. Acted as an escalation point for threat monitoring, driving resolution of high-priority security incidents. Implemented and enhanced email security, web security, and infrastructure applications to improve security posture. Researched and solved adoption challenges related to new technologies, facilitating smoother transitions for operating companies. Supported the translation of regulatory requirements into technical deliverables for both in-flight and post-delivery projects. Worked closely with cross-functional teams (Operations, Engineering) to deliver infrastructure rollouts, cloud deployments, and penetration testing initiatives. Demonstrated strong technical expertise in networking, operating systems, and database management, with a focus on risk management. Proven ability to articulate complex technical issues to diverse audiences, ensuring clear communication and understanding. Strong relationship management skills, with an ability to influence stakeholders and align security practices with business goals.

• Triaging and responding to critical security incidents, ensuring rapid containment and mitigation. • Mentoring and training Tier 1 & Tier 2 analysts, enhancing their technical skills and incident handling capabilities. • Leading threat hunting initiatives across EMEA GSOC, driving proactive threat detection and intelligence-sharing in weekly sessions. • Developing and optimising new use cases for detecting active exploits and vulnerabilities, strengthening security posture. • Refining EDR/XDR alerting rules, significantly reducing false positives through historical data analysis and fine-tuned detections. • Performing in-depth malware analysis on emerging threats from client environments and threat intelligence feeds. • Conducting sandbox testing using Triage! SOAR on D3! for automated incident response, along with static and dynamic analysis on Flare-VM for deeper malware investigation. • Managing and guiding a team of security analysts, fostering a high-performance cybersecurity operations environment.

•Triaging and responding to Critical Security Incidents. •Responsible for mentoring T1’s and triage escalated alerts from them. •Actively working and building new use cases related to active exploit & vulnerability. •Performing malware analysis on newly found malware on client environments. •Sandbox analysis on Triage platform! SOAR on D3! Static and Dynamic on Flare-VM.

• Actively participating in incident response and threat mitigation, ensuring swift action during security events. • Conducting in-depth technical analysis of security incidents, including malware analysis, network packet inspection, and system-level forensic investigations. • Performing compromise assessments to detect and analyze potential security breaches. • Collecting and examining disk and memory images to uncover evidence related to cyber incidents. Developing and refining incident response plans and procedures, covering detection, containment, eradication, and remediation strategies. • Leading client-facing incident engagements, providing expert guidance and actionable insights. • Managing stakeholder communication, ensuring timely updates and strategic recommendations. • Writing detailed reports for clients, documenting findings, incident timelines, and remediation steps. • Utilizing the MITRE ATT&CK framework to map adversary tactics and techniques, enhancing threat intelligence and detection strategies.

• Analysis of BlackBerry product data and BlackBerry compromise assessment data • Incident Response (IR) support and recommendations when analysis confirms actionable incident • Investigate, document, and report on information security issues and emerging trends in the industry, in order to feed into the threat hunting element of the service • Coordinate with other analysts on activities impacting a diverse customer base • Integrate and share information with other analysts and other teams • Working with, training and mentoring of junior team members

• Certified IBM QRadar Security Professional- 2019 & IBM QRadar SIEM Foundation. • Respond to security events react appropriately to protect Internal and Client information and assets. • Utilize endpoint products to identify malicious activity on the network. • Review daily, weekly, and monthly reports for actionable tasks for the SOC. • Ensure appropriate security incident management and threat response processes are followed. • Analyse SOC functions and recommend upgrades/changes to ensure the security of the Company. • Continuously assess current state of security monitoring and recommend changes for improvement. • Proactively conduct research of client network traffic and system activity looking for security anomalies and suspicious activities. • Perform Advanced Persistent Threat correlation between multiple security event sources such as firewall logs, threat intelligence feeds, AV, IDS & IPS. • Responsible for tuning and implementing configuration changes related to firewalls, IDS/IPS, endpoint security, SIEM, and other security tools, as necessary. • Design and deploy Vulnerability Management and remediate risks. • Create and maintain process documents related to SOC in line with ISO27001 controls. • In depth technical understanding of threats, vulnerabilities, and exploits.

Respond to security events react appropriately to protect Internal and Client information and assets. Review daily, weekly, and monthly reports for actionable tasks for the SOC. Ensure appropriate security incident management and threat response processes are followed. Analyse SOC functions and recommend upgrades/changes to ensure the security of the Company. Proactively conduct research of client network traffic and system activity looking for security anomalies and suspicious activities. Perform Advanced Persistent Threat correlation between multiple security event sources such as firewall logs, threat intelligence feeds, AV, IDS & IPS. Responsible for tuning and implementing configuration changes related to firewalls, IDS/IPS, endpoint security, SIEM, and other security tools, as necessary. Design and deploy Vulnerability Management and remediate risks In depth technical understanding of threats, vulnerabilities, and exploits.

•Performing Penetration testing on Hacker-One client application. •Testing the client website using BurpSuite and report bugs accordingly.

-Elasticsearch and Search Guard products and implementations. -Proactively assisting them with post-sales installation, configuration and set up tasks. -Proactively working with the Support team to triage and resolve highly complex, technical, and application-related issues. -Extensively research and document customer software and technical issues -Collaborating with Development and Sales Consultants to identify high priority issues and partner with Development teams as needed.

• Performing Penetration testing on client application. • Testing the client website using Burpsuite and report bugs accordingly. • Implemented basic security on Website against XSS, SQL-I, D-dos, Session management etc. • Developing Website. • Language: - HTML5, CSS3, java-Script.

• Manual testing of applications using Burp-Suit to find bugs. • Worked on vulnerability assessments on more than 100+ web applications and provided solution to fix it. • Performing Source code analysis of java and asp.net using HP fortify and HP Web inspect and generate the FPR report for the client. • Good knowledge in Application Vulnerability Audits and analysis, manually and also with the help of scanning tools. • Good knowledge in scripting languages like Java. • Providing proper recommendations and solutions to the client.

Post Grad in Cyber Security. 1st Semester. 1. Secure Programming for Web. ( Created an E-commerce Website with OSWAP security Features like SQL Injection, Password Storage Mechanism, Brute Force Attack, Session ID Management Etc. with Minimum knowledge on HTML, SQL, ASP.NET, JavaScript . 2. Network and Penetration Testing ( Wi-fi Cracking and Handshake Network Security, System Vulnerability, Open Ports, Social Engineering etc. ) 3. Security Fundamentals 4. IT law and Ethics 2nd Semester 1. Malware Analysis: - Set-up a VMware lab for Malware Analysis and Performed Analysis for a given Malware using Malware analysis tool. 2.Secure Programming for Application 3. Research in computing (Doing my Research on Internet of Drones IoD: Secure Data Aggregation) 4. Forensic - E-discovery and Incident Response.

Programming of C, C++, HTML. Projects: - Programming on C++ , HTML, Network Analysis, SQL.