Looking for a job

Dhruv Sawhney

@dhruvsawhney

SOC operations leader at ANKURA CONSULTING GROUP who manages cloud-security delivery and strengthens Microsoft Sentinel detection coverage.

India

Message

At ANKURA CONSULTING GROUP, I lead SOC and cloud-security delivery across an MSSP/client environment, managing SOC and engineering teams. I strengthen Microsoft Sentinel coverage by integrating firewall, proxy, DNS, and Windows telemetry.

I build and maintain detection-use-case libraries aligned with available log sources, threats, and client requirements. I also reduce manual work through Azure Logic Apps and workflow integrations with ServiceNow and Jira.

At DELOITTE, I led cloud SOC operations and security-service delivery, managed a SOC team, and operationalized Microsoft Sentinel detection capabilities, threat hunting, SOPs, and playbooks. I automated reporting and repetitive activities using Azure Automation and Microsoft Sentinel Playbooks.

Earlier, I handled L2 SOC operations at DELOITTE and security operations at HCL TECHNOLOGIES, including escalated-event analysis, incident response, threat hunting, and custom detection rules. I hold Microsoft Azure AZ-900 and AZ-104 certifications, and am pursuing CISM.

Experience

Work history, roles, and key accomplishments

Current

Director – Cloud Engineering

Current

Ankura Consulting Group

Jun 2024 - Present (2 years 3 months)

Led SOC and cloud-security delivery for an MSSP/client environment averaging 20–30 clients, managing approximately 15 SOC and 6–10 engineering team members. Strengthened Microsoft Sentinel monitoring coverage and built detection-use-case libraries.

Microsoft Sentinel Azure Logic Apps ServiceNow Jira Purview DLP Threat Hunting SIEM Cost Optimization Detection Engineering Cloud Security Incident Management

Assistant Manager – Cloud Security

Deloitte

Jun 2021 - Jun 2024 (3 years)

Led cloud SOC operations and end-to-end security-service delivery for an MSSP/client environment averaging 20–30 clients. Built and managed a cloud-security consulting team of approximately 20 SOC members, improving SIEM onboarding and operationalizing Microsoft Sentinel detection capabilities.

Microsoft Sentinel Azure Automation Sentinel Playbooks Architecture SIEM Threat Hunting SOC Team Leadership Client Reporting Endpoint Security

Consultant – Cybersecurity / L2 SOC

Deloitte

Apr 2020 - Jun 2021 (1 year 2 months)

Led L2 SOC operations across ArcSight, QRadar, and Microsoft Sentinel, providing technical guidance and advanced analysis for escalated security events. Developed SOC playbooks, SOPs, detection rules, and conducted proactive threat hunting.

ArcSight QRadar Microsoft Sentinel SOC Operations Incident Response Threat Hunting Root Cause Analysis Playbooks SOPs Detection Rule Development

Senior Analyst

HCL Technologies

Jun 2019 - Apr 2020 (10 months)

Advanced to L2 security operations, resolving incidents, performing root cause analysis, and managing escalated client communications. Supported enterprise SIEM operations with ArcSight and LogRhythm, developing custom detection queries and security rules.

ArcSight LogRhythm SIEM Incident Response Root Cause Analysis Detection Queries Security Policies Client Reporting

Graduate Engineer Trainee (GET)

HCL Technologies

Oct 2017 - Jun 2019 (1 year 8 months)

Monitored and triaged security alerts across enterprise ArcSight and LogRhythm SIEM platforms. Supported incident response, security analysis, and client reporting, and created custom dashboards for operational efficiency.

ArcSight LogRhythm SIEM Security Monitoring Incident Response Threat Analysis Dashboard Creation Client Reporting