Nagarajan TSecurity Engineer

Security Engineer · SOC · Digital Forensics

Every alert
is a lead.

Nagarajan ThathasamySecurity Engineer

Security Engineer defending 40,000 endpoints across cloud and on-prem, from Falcon full administration and DLP policy engineering to hands-on digital forensics and incident response. I turn raw telemetry into detections, contain threats at L2/L3, and automate the SOC so defenders move faster than adversaries.

View my work Download resume
  • SC-200 certified
  • 40k+ endpoints
  • L2 / L3 engineer

Open to Security Engineer · SOC · Threat Hunting roles

Representative detection — telemetry in, threat out: caught, mapped to ATT&CK, contained.
Case file · NT-2026
Subject
Nagarajan Thathasamy
Role
Security Engineer · L2 / L3
Employer
Zoho Corporation
Based in
India
Status
Open to new roles

Profile

Professional summary

SC-200-certified Security Engineer with a defender-minded, detection-engineering focus spanning SIEM/NG-SIEM, EDR/XDR, DLP, vulnerability management, cloud security, and digital forensics. Currently administering CrowdStrike Falcon, Cynet XDR, and Forcepoint DLP across a 40,000-endpoint estate at Zoho, after a SOC tenure resolving 1,000+ alerts/month across a 24/7 SIEM-EDR-AV-IDS-WAF-firewall-DLP stack. I pair deep tooling expertise with Python automation, MITRE ATT&CK-driven hunting, and rigorous RCA to shorten dwell time and cut critical-vulnerability exposure.

  • 3+ yrsSecurity operations experience
  • 40,000+Endpoints administered
  • 1,000+Alerts resolved / month
  • 40%Critical vulnerabilities cut

Tools & platforms

The stack I operate

Hands-on across the enterprise security stack — SIEM / NG-SIEM, EDR / XDR, DLP, vulnerability, cloud and digital-forensics tooling.

IBM QRadar
CrowdStrike Falcon
SC-200Certified
Microsoft Azure
Forcepoint DLP
AWS
Magnet AXIOM (Magnet Forensics)
FortiGate Firewall (Fortinet)
YARArules
Tenable Nessus
SpyCloud
Trend Micro Apex
Cynet XDR
Blue team

Expertise

What I defend

Every capability below is one I operate or administer hands-on across enterprise-scale security operations.

SIEM & Detection Engineering

Author, tune, and operationalize detection rules and daily log analytics across enterprise SIEM and NG-SIEM platforms, onboarding log sources with custom parsers and queries to close visibility gaps.

CrowdStrike Falcon LogScale (NG-SIEM) · IBM QRadar · FortiSIEM · Azure Sentinel

EDR / XDR & Endpoint Security

Full-lifecycle CrowdStrike Falcon administration across 40,000 endpoints — custom IOAs, detection/prevention rule exclusions, sensor deployment and health, host groups, and device/USB control — plus XDR operations and host-based firewall policy management.

CrowdStrike Falcon (full admin) · Cynet XDR · Trend Micro Apex One · host-based firewall

Data Loss Prevention (DLP)

Administer enterprise DLP end to end: author regex-based policies and classifiers, push them to endpoints, and investigate DLP incidents to detect and stop data exfiltration while improving data-sharing compliance.

Forcepoint DLP (regex policy authoring & push) · data-sharing log analysis

Threat Hunting & Incident Response

Drive L2/L3 incident response through triage, containment, eradication, root-cause analysis, and reporting, with proactive MITRE ATT&CK-mapped hunting and SLA-bound P1-P3 tracking; resolved 1,000+ alerts/month in a prior 24/7 SOC.

ServiceNow · MITRE ATT&CK · Cyber Kill Chain · NIST CSF

Digital Forensics

Perform forensically sound image acquisition and multi-artifact investigation across memory, disk, and log evidence to reconstruct incidents and support RCA.

Magnet AXIOM · Cellebrite · memory / disk / log analysis

Malware Analysis & Threat Intelligence

Analyze malware in isolated VMs and author YARA rules from extracted IOCs, and fuse dark-web credential monitoring, phishing investigation, and OSINT/CVE intelligence into actionable detections and triage-to-reset workflows.

YARA · isolated analysis VMs · SpyCloud (dark-web) · OSINT threat intel · CVE / security bulletins

Vulnerability Management

Run 150+ monthly authenticated scans across hybrid environments, identify and prioritize exposures with CVSS, and collaborate with patch teams to remediate — reducing critical vulnerabilities by 40%.

Nessus · Qualys · CVSS · patch management

Cloud Security

Secure AWS and Azure workloads by integrating native detection and posture services into centralized monitoring and response.

AWS GuardDuty · AWS Inspector · Microsoft Azure / Sentinel

Security Automation & Deception

Develop, implement, and integrate custom security tooling in Python to automate scanning and analysis, and deploy honeypots across multiple Zoho locations for early threat detection.

Python · honeypot / deception · tool integration & implementation

Methodology

How I run an incident

The same disciplined loop every time — whether it's a single phishing mail or a multi-host intrusion.

  1. Detect

    Catch the signal

    Falcon / Cynet detections correlated with SIEM & LogScale telemetry.

  2. Triage

    Validate & scope

    Severity, blast radius and ATT&CK mapping; P1–P3 tracked in ServiceNow.

  3. Contain

    Stop the spread

    Network containment, host isolation, credential resets, firewall blocks.

  4. Eradicate

    Remove the threat

    Root out persistence, patch and harden — with forensics when evidence matters.

  5. Learn

    Come back stronger

    RCA, new detections and YARA rules, runbook updates and reporting.

Selected work

Problem → approach → outcome

Representative engagements from day-to-day operations. Sensitive specifics are generalized.

Incident response
Incident reportContained

Endpoint intrusion contained through CrowdStrike–QRadar–firewall correlation

Problem
A CrowdStrike Falcon endpoint detection needed validation — endpoint signal alone lacked the network and identity context to judge whether it was a real intrusion or noise.
Approach
Correlated Falcon detections with IBM QRadar logs and FortiGate firewall traffic, tracked the incident P1–P3 in ServiceNow, mapped the activity to MITRE ATT&CK, contained the host via Falcon, and ran root-cause analysis with preventive recommendations.
Outcome
Threat contained and root-caused; detection feedback and tuning reduced repeat false positives across the SOC.
  • 1,000+ alerts / month
  • P1–P3 SLA adherence
  • RCA → prevention

CrowdStrike Falcon · IBM QRadar · FortiGate firewall · ServiceNow · MITRE ATT&CK

Deception & monitoring
Deployment recordDeployed

Distributed honeypot network across Zoho locations for early threat detection

Problem
The organization needed early-warning visibility into attacker reconnaissance and lateral probing spread across multiple corporate locations.
Approach
Designed and deployed honeypots across multiple Zoho locations, wired their telemetry into SIEM monitoring, and built alerting so any interaction surfaces immediately as a high-fidelity signal for investigation.
Outcome
A multi-site early-warning sensor grid that flags reconnaissance and unauthorized probing with near-zero false positives, feeding straight into incident response.
  • Multi-site coverage
  • High-fidelity alerts
  • SIEM-integrated

Honeypots · SIEM · Custom automation

Digital forensics
Forensic examinationEvidence-grade

Forensic acquisition and memory analysis supporting incident investigations

Problem
Investigations required defensible evidence and deeper host analysis than live EDR telemetry alone could provide.
Approach
Performed disk and mobile image acquisition with Magnet AXIOM and Cellebrite, conducted memory, disk and log analysis, and correlated findings against SIEM and EDR timelines to reconstruct the sequence of events.
Outcome
Reconstructed attacker activity and produced evidence-grade findings that guided containment, remediation and reporting.
  • Disk & mobile acquisition
  • Memory analysis
  • Timeline reconstruction

Magnet AXIOM · Cellebrite · Memory analysis · SIEM / EDR

Threat intel & dark web
Exposure responseReset

Dark-web leaked-credential monitoring with SpyCloud and custom tooling

Problem
Leaked corporate credentials surfacing in breach dumps and combolists needed continuous detection and fast response before attackers could use them.
Approach
Operated SpyCloud monitoring of corporate domains with a triage-to-reset workflow, and built security automation and tooling to accelerate detection, validation and response.
Outcome
Leaked credentials identified and reset quickly, shrinking the window of exposure and turning dark-web intelligence into routine, measurable work.
  • Continuous monitoring
  • Rapid reset
  • Custom tooling

SpyCloud · Python automation · Directory / IAM

Project · Vuln-MS
Project brief · built end to endShipped

Vuln-MS — a web-based vulnerability management platform

What I built
A platform that automates vulnerability scanning, tracking and remediation across internal, external and cloud assets — with scheduled quarterly scans for consistent coverage, role-based access control (RBAC) for secure data handling and compliance, interactive dashboards for vulnerability trends and remediation status, and an integrated ticketing system to streamline resolution.
  • 150+ scans / month
  • 40% critical-vuln remediation
  • RBAC + dashboards + ticketing

Python · Nessus · Automated scheduling · RBAC · Dashboards · Ticketing

Products

Products I engineered

Two full security platforms I designed and built end to end — click the tabs to move through each app, or click a screen to view it full-size.

Self-built · Detection & IR platform

LogSec — AI Log-Security Platform

A case-based SIEM and investigation platform: ingest millions of log events, auto-detect threats, map them to MITRE ATT&CK, and generate agentic-LLM incident triage and reports — all on a local LLM, so no data ever leaves the box.

  • Case workspace searching 1.6M+ events per file in sub-second
  • ML + rule detection pipeline mapped to MITRE ATT&CK
  • Agentic-LLM triage & auto-report (local Ollama or Claude)
  • Attack-timeline reconstruction + built-in .eml phishing analyzer

Stack: Python · Local LLM · MITRE ATT&CK · ML detection · Sigma / YARA

logsec.local/cases
LogSec cases workspace LogSec dashboard with agentic-LLM triage LogSec attack timeline LogSec event search over 1.6M events LogSec alerts mapped to MITRE ATT&CK LogSec AI triage report LogSec email phishing analyzer Click to zoom
Self-built · Exposure & dark-web recon

GIT Recon — Exposure Scanner

A reconnaissance platform that hunts an organization’s leaked secrets across public GitHub — discovering repos, scanning code for tokens, keys and passwords, scoring severity and confidence, and exporting actionable findings for remediation.

  • Org-keyword discovery with authenticated cloning & crawl mode
  • 7,000+ findings triaged by severity, confidence & category
  • Custom engine surfacing OAuth tokens, private keys, GCP service accounts
  • Exposure dashboards + JSON / CSV / report export

Stack: Python · GitHub API · code-search crawler · entropy + regex · dashboard UI

gitrecon.local/overview
GIT Recon exposure overview GIT Recon scan console GIT Recon global findings Click to zoom

Experience

Career timeline

Detailed day-to-day responsibilities across both roles — from L2/L3 security engineering at Zoho to 24/7 SOC operations at Intellect Design Arena.

Aug 2025 – Present · India

Security Engineer Zoho Corporation

L2/L3 security engineer owning detection, endpoint, DLP, logging, vulnerability, cloud, forensics and deception operations across a 40,000+ endpoint estate. Day to day:

  • CrowdStrike Falcon — full administrationSensor deployment and health, prevention & response policy configuration, host groups, and USB/device control across 40,000+ endpoints.
  • Detection tuning & rule exclusionsAuthor and manage Falcon detection/prevention exclusions and custom IOAs to cut false positives without losing true-positive coverage.
  • Endpoint / host firewallConfigure and maintain host-based firewall policies across the endpoint estate.
  • Forcepoint DLP policy engineeringWrite and tune regex-based classifiers and DLP policies, push them to endpoints, and investigate and disposition DLP incidents to prevent data exfiltration.
  • SIEM rule engineering & log analysisBuild and fine-tune SIEM detection and correlation rules, and perform daily log analysis to hunt, validate and escalate threats.
  • LogScale log-source integrationOnboard and integrate log sources into CrowdStrike Falcon LogScale (NG-SIEM), building parsers and queries to expand detection coverage.
  • Cynet XDR operationsOperate Cynet XDR for cross-layer detection, correlation and response.
  • Dark-web monitoringRun SpyCloud continuous monitoring for leaked corporate credentials with a triage-to-reset workflow.
  • Vulnerability managementRun Nessus authenticated scanning and drive prioritized remediation to closure.
  • Digital forensicsDisk and mobile image acquisition with Magnet AXIOM and Cellebrite, plus memory, disk and log analysis for investigations.
  • DeceptionDeploy and monitor honeypots across multiple Zoho locations for early threat detection.
  • Cloud securityMonitor and harden AWS and Azure workloads across the hybrid estate.
  • Automation & toolingDevelop custom security tools and automation in Python, and implement and integrate new security tooling.
  • Incident responseLead L2/L3 IR end to end — triage, containment, eradication, root-cause analysis and reporting.

CrowdStrike Falcon & LogScale · Cynet XDR · Forcepoint DLP · SpyCloud · Magnet AXIOM / Cellebrite · Nessus · AWS / Azure · Python

Jun 2023 – Aug 2025 · India

Security Operations Center Analyst Intellect Design Arena

24/7 SOC monitoring, detection and response across SIEM, EDR, AV, IDS, WAF, firewall and DLP tooling. Day to day:

  • Alert triage & monitoringResolved 1,000+ security alerts/month across the full SOC toolset, improving detection and neutralization efficiency and significantly reducing false positives.
  • SIEM log analysisAnalysed logs from IBM QRadar, FortiSIEM and Azure Sentinel to discover, correlate and analyse security events.
  • Incident managementTracked and prioritized incidents (P1–P3) in ServiceNow, ensuring SLA adherence and timely resolution.
  • Endpoint incident responseLed endpoint IR using CrowdStrike and Trend Micro Apex EDR platforms.
  • Phishing investigationAnalysed suspicious emails, domains and IPs using open-source threat-intelligence tools.
  • DLP monitoringImproved DLP compliance by analysing data-sharing logs to prevent unauthorized data exfiltration.
  • Threat framing & huntingMapped incidents to MITRE ATT&CK, enabling structured threat analysis and pre-emptive hunting.
  • Malware analysis & RCAPerformed malware analysis and authored YARA rules from IOCs in isolated virtual environments; executed root-cause analysis with preventive recommendations.
  • Vulnerability managementRan 150+ monthly vulnerability scans with Nessus and Qualys across hybrid environments; collaborated with patch teams to remediate critical vulnerabilities by 40%.
  • Cloud & automationIntegrated AWS GuardDuty & Inspector into monitoring workflows; automated vulnerability scanning and data analysis with Python; monitored CVE databases and bulletins for real-time updates.
  • ReportingProduced daily, weekly and monthly security reports based on client requirements.

IBM QRadar · FortiSIEM · Azure Sentinel · CrowdStrike / Trend Micro Apex · Nessus / Qualys · ServiceNow · Python

Technical skills

Complete skill inventory

The full toolkit — grouped by capability so nothing I work with is left off the page.

Inventory — technical skills15 categories · verified hands-on

SIEM & NG-SIEM

  • CrowdStrike Falcon LogScale (NG-SIEM)
  • IBM QRadar
  • FortiSIEM
  • Azure Sentinel
  • Log source onboarding
  • Custom parsers & queries
  • Rule creation / tuning
  • Daily log analysis

EDR / XDR & Endpoint

  • CrowdStrike Falcon (full administration)
  • Custom IOAs
  • Detection / prevention rule exclusions
  • Sensor deployment & health
  • Host groups
  • Device / USB control
  • Cynet XDR
  • Trend Micro Apex One

DLP

  • Forcepoint DLP administration
  • Regex policy & classifier authoring
  • Policy push to endpoints
  • DLP incident investigation
  • Exfiltration prevention
  • Data-sharing compliance

Vulnerability Management

  • Nessus
  • Qualys
  • 150+ scans / month
  • Hybrid-environment scanning
  • Identification
  • Prioritization
  • Remediation
  • Patch collaboration (40% critical reduction)

Cloud Security

  • AWS GuardDuty
  • AWS Inspector
  • Microsoft Azure
  • Cloud monitoring integration

Digital Forensics & Tools

  • Magnet AXIOM
  • Cellebrite
  • Image acquisition
  • Memory analysis
  • Disk analysis
  • Log analysis
  • Data analysis

Threat Intelligence

  • SpyCloud dark-web credential monitoring
  • OSINT
  • Phishing investigation (emails / domains / IPs)
  • CVE & security bulletin monitoring
  • IOC extraction

Malware Analysis

  • YARA rule authoring
  • Isolated VM analysis
  • IOC-driven detection

Network & Firewall Security

  • IDS
  • WAF
  • AV
  • Network firewall
  • Host-based / endpoint firewall policy
  • Network security

Honeypot / Deception

  • Multi-location honeypot implementation
  • Threat monitoring

ITSM

  • ServiceNow
  • P1–P3 incident tracking
  • Prioritization
  • SLA management

Frameworks

  • MITRE ATT&CK
  • Cyber Kill Chain
  • NIST CSF
  • CVSS

Operating Systems

  • Windows
  • Linux

Scripting & Automation

  • Python
  • Security tool development
  • Vulnerability-scan automation
  • Data-analysis automation
  • Tool implementation & integration

Incident Response & Operations

  • L2 / L3 IR
  • Triage
  • Containment
  • Eradication
  • Root Cause Analysis (RCA)
  • Preventive measures
  • Security hardening
  • Patch management
  • Daily / weekly / monthly reporting

Credentials

Certifications, education & frameworks

Certification · Microsoft

Microsoft Certified: Security Operations Analyst Associate (SC-200)

Microsoft Certified
N. ThathasamyHolder

MCA, Computer Science

Manipal University Jaipur2024 – Present

B.Sc. Computer Science with CTIS

Rathinam College of Arts & Science2020 – 2023

ATT&CK techniques I work with most

Highlighted = hands-on detection & response

Initial AccessT1566Phishing
ExecutionT1059Command & Scripting Interpreter
PersistenceT1078Valid Accounts
Credential AccessT1003OS Credential DumpingT1552Unsecured Credentials
Lateral MovementT1021Remote Services
ExfiltrationT1041Exfiltration Over C2 Channel
ImpactT1486Data Encrypted for Impact

Frameworks, standards & core skills

  • MITRE ATT&CK
  • Cyber Kill Chain
  • NIST CSF
  • CVSS
  • Incident Response
  • Root Cause Analysis
  • Security Hardening
  • Network Security
  • Patch Management
  • Windows / Linux
  • Python

Let's work together

Open to security engineering & SOC roles

If you're building or running a detection program and need someone who treats alerts as leads and noise as a bug — let's talk.

Email me Download resume
nagarajan.thathasamy@gmail.com +91 63740 99735 LinkedIn ↗