Nutan Vishwakarma

About Nutan Vishwakarma

Security Operations and Incident Response leader with over a decade of experience managing 24x7 SOC environments, leading analyst teams through high-volume alert triage, threat investigations, and coordinated incident response across enterprise and cloud ecosystems.Experienced in shift governance, escalation management, and investigation quality reviews aligned to SLA-driven monitoring models. I translate recurring alerts and threat patterns into structured runbooks, telemetry improvements, and automation pathways to improve detection fidelity and reduce MTTR.Hands-on in managing identity and cloud-driven security incidents including MFA abuse, Conditional Access drift, OAuth misuse, token sync anomalies, and authentication-based attack vectors across SIEM and EDR platforms.Regularly lead major incident coordination including war room facilitation, stakeholder communication, executive incident briefings, and Post Incident Reviews (PIR) to address monitoring gaps and repeat attack patterns.Focused on measurable SOC delivery through monitoring coverage governance, MITRE ATT & CK–aligned detections, threat-informed defense, and continuous response improvement aligned with ISO 27001 / NIST-oriented monitoring programs.Driven to build stable, metrics-led security operations that reduce attacker dwell time, improve containment timelines, and enhance response consistency across evolving enterprise environments.

Experience

1. Senior Architect - Security Operations

   Microsoft

   Oct 2024 — Present · IN

   I design, implement and lead SOC capabilities across multi-tenant and multi-cloud environments, focusing on scalable detection engineering, investigation workflows, and incident response systems and processes. My work enables consistent monitoring across diverse tenants and strengthens the cloud-ready SOC operating model.I architect large-scale telemetry and detection systems, including ingestion pipelines, onboarding/offboarding workflows, and continuous containment patterns that process hundreds of terabytes per hour. This includes defining data-quality controls, retention governance, normalization, and platform integrations that improve detection fidelity and reduce noise.I build systemized detection platforms for cloud, identity, endpoint, and network telemetry, ensuring detections are high-confidence, maintainable, and aligned to threat-informed architecture. I use MITRE ATT & CK, D3FEND, and internal maturity models to identify gaps, define roadmaps, and improve TTD, MTTR, and automation.A key part of my role is evaluating and designing AI guardrails for phishing, malware, identity, and cloud investigations. I define patterns for AI-assisted reasoning, evidence validation, chain-of-custody protection, and escalation boundaries. I also design governed agentic AI frameworks that support assisted triage and bounded workflow actions.I work across engineering, identity, GRC, threat intelligence, cloud operations, and SOC teams to define service boundaries, expectations, and telemetry standards. I lead design reviews, reference architecture work, and cross-team implementation with virtual teams of 10–40 professionals.My focus is building stable, scalable, AI-ready SOC capabilities that measurably improve detection quality, threat visibility, and operational resilience.

Education

• Kendriya Vidyalaya

  10 (Xth), As per CBSE Syllabus

  2001 — 2002

• BBD National Institute of Technology and Management, Lucknow

  B.Tech (CSE), Computer Science and Engineering

  2004 — 2009

• Kendriya Vidyalaya

  12 (XII th), Informatic Practices with Non Medical Sciences

  2003 — 2004

Skills

• Vulnerability Management
• Dlp
• Intrusion Detection
• Metasploit
• Ids
• Networking
• Mcafee
• Malware Analysis
• Cissp
• Network Design
• Penetration Testing
• Websense
• Pci Dss
• Cloud Security
• Computer Forensics
• Risk Assessment
• Internet Security
• Network Administration
• Juniper
• Information Security
• Ccna
• Backtrack
• Business Continuity
• Siem
• Data Security
• Network Security
• Computer Security
• Log
• Firewalls
• Content Filtering
• Vpn
• Checkpoint
• Cism
• Security
• Vulnerability Assessment
• Iso 27001
• Snort
• Vulnerability Scanning
• Ceh
• Information Security Management