Sunny Shah

Insider Trust — SDR

• Built and deployed production-grade SQL detections on billion-row datasets supporting 4B+ users, using TTP-based threat modeling to align coverage with real-world attacker behaviors.
• Reduced false positives by 60% and cut compute costs by 95% through detection tuning, query optimization, and structured validation in controlled test environments.
• Designed scalable response automation workflows adopted across 10+ detections, decreasing alert triage time by 40% and contributing to a 25% reduction in MTTR.
• Identified and closed a detection gap between data exfiltration and downstream misuse by engineering correlation logic that strengthened defense-in-depth controls.
• Collaborated with Security Operations and Incident Response to investigate high-fidelity alerts, shadow SEV escalations, and deliver a standardized threat response playbook.

• Led Tier 1 SOC triage in a 24/7 environment, analyzing 150–200 daily SIEM/EDR alerts (Splunk, Microsoft Sentinel, Wazuh) and reducing MTTR by 30% across phishing, malware, and intrusion cases.
• Performed static and dynamic malware analysis in sandbox environments, extracting IOCs and identifying C2 activity to accelerate threat containment by 40%.
• Strengthened detection quality by tuning SIEM correlation rules using SPL and KQL, decreasing false positives by 25% and improving alert fidelity.
• Investigated OWASP Top 10 web application attacks and conducted internal penetration testing, driving remediation that reduced high-risk vulnerabilities by 25%.
• Mapped adversary TTPs to MITRE ATT&CK and authored executive-ready incident reports, maintaining 95%+ SLA compliance while improving cross-team coordination.

• Secured 500+ endpoints across multi-client environments by triaging 40–60 daily alerts using Splunk, Suricata (IDS/IPS), and FortiGate, detecting phishing, malware callbacks, and unauthorized access.
• Improved SOC efficiency by reducing false positives by 35% through detection tuning, correlation rule refinement, and IDS threshold optimization.
• Accelerated investigations via host and network forensic analysis (Windows/Linux logs, PCAP), improving mean time to detect by 25%.
• Strengthened containment with firewall rule updates, IP/domain blocking, and access control corrections, contributing to a 20% reduction in MTTR.
• Identified exploitable attack paths through vulnerability scanning (Nmap) and validation (Metasploit, Burp Suite), driving remediation that reduced external risk exposure by 40%.