Varun B.

About Varun B.

I am a Cyber Security Consultant specializing in SOC operations, threat detection, and incident response. With hands-on expertise in CrowdStrike, SUMO Logic, NetScope, ProofPoint, Imperva, Axonius, and DLP solutions, I help organizations strengthen their security posture through real-time threat monitoring, automation, and proactive defense strategies.My focus is on endpoint security, SIEM, cloud security, and data protection, leveraging advanced security tools to detect, analyze, and mitigate cyber threats. I work closely with cross-functional security teams to optimize SOC workflows, reduce false positives, and ensure compliance with industry standards.Key Expertise: SOC Operations & Threat Detection – Real-time monitoring, log analysis, incident response, and automation. Endpoint Security (CrowdStrike Falcon) – EDR/XDR, custom detections, and threat intelligence integration. SIEM & Log Management (SUMO Logic) – Log correlation, custom rules, and security analytics. Cloud Security & CASB (NetScope, Imperva, ProofPoint) – Securing SaaS, WAF policies, and email security. DLP & Asset Visibility (Axonius) – Data loss prevention, asset compliance, and security audits. Incident Response & Threat Hunting – MITRE ATT & CK mapping, malware analysis, and risk mitigation.I am passionate about automating security processes, improving SOC efficiency, and defending against evolving cyber threats. Let’s connect to discuss security strategies and the future of threat detection!

Experience

1. Sr Cyber Security Consultant

   Positivity

   Apr 2023 — Present · Atlanta, GA, US

   I lead threat detection, incident response, and threat hunting across hybrid enterprise environments, partnering with SOC, Security Engineering, CTI, and CSIRT teams to counter advanced adversaries.My work spans EDR/XDR, SIEM, CTI operationalization, and DLP engineering, turning telemetry into high-fidelity detections and rapid containment.I bring hands-on expertise across CrowdStrike Falcon, Sumo Logic, Netskope, Proofpoint, Imperva, Axonius, and cloud security platforms to investigate and disrupt real-world attacks.Security Operations & Threat Detection• Real-time monitoring and response across endpoint, identity, network, and cloud telemetry• Built SIEM correlation rules, dashboards, and automated playbooks detecting abnormal logins, lateral movement, data exfiltration, exploits, and C2 trafficEndpoint Security & EDR/XDR – CrowdStrike Falcon• Led threat hunts and forensic investigations using Falcon XDR• Engineered IOA/IOC detections for ransomware, credential theft, MSHTA abuse, registry persistence, Scattered Spider techniques• Built post-exploitation visibility for PSExec, DCsync, WMI, and remote PowerShellSIEM Engineering – Sumo Logic• Onboarded and normalized Windows, Linux, cloud, and security tool logs• Created advanced analytics for privilege misuse, brute force, SQL abuse, and anomalous activityIncident Response, CTI & Threat Hunting• Mapped investigations to MITRE ATT & CK techniques• Converted ransomware/APT intel into live EDR & SIEM detections• Hunted C2 infrastructure, anomalous DNS, P2P traffic, and persistenceDLP & Insider Threat• Investigated data leakage using Netskope and Proofpoint• Tuned DLP policies to prevent PII/PCI exposure across email and cloud platformsAdvanced Identity Breach Response• Detected and contained Kerberos Golden Ticket compromise (KRBTGT hash abuse, forged tickets, stealth Domain Admin access)• Built long-term EDR/SIEM protections for credential dumping and Kerberos anomalies

Education

• K.B D.A.V SCHOOL (CHANDIGARH)

  SSC, Science

  2006 — 2007

• D.A.V PUBLIC SCHOOL

  HSC, Science

  2004 — 2005

• Texas A&M University

  Master's degree, Cyber security