Open to opportunities

Mahadevan User

@mahadevanuser

Message

I build SOAR workflows that automate detection, investigation, and endpoint response.

India

Message

What I'm looking for

I'm looking to build security automation that connects detection, investigation, and remediation, while partnering with SOC, IT, and DevOps teams to improve response speed, alert fidelity, and security outcomes.

At Expeditors, I build Tines SOAR playbooks that connect Exabeam, Microsoft Defender, Google Threat Intelligence, and Microsoft Teams—from alert enrichment through analyst-approved endpoint remediation. I also built an MCP-based AI security assistant for natural-language case investigation and a GitOps certificate lifecycle platform that reduced processing from 40–45 minutes to seconds.

I've spent five years improving detection engineering, threat hunting, phishing investigations, malware analysis, incident containment, and identity security. I map detections to MITRE ATT&CK, refine SIEM rules to improve alert fidelity, and work with SOC, IT, DevOps, and Risk Management teams to turn security requirements into practical automation.

Experience

Work history, roles, and key accomplishments

Current

Cybersecurity Specialist II

Current

Expeditors

Dec 2024 - Present (1 year 8 months)

Designed and built SOAR playbooks in Tines for alert enrichment, threat intel lookups, and automated response, reducing manual incident triage time. Built automated endpoint response playbooks via Microsoft Defender APIs and implemented an MCP-based AI security assistant integrating Exabeam with LLMs.

Tines Python REST APIs Microsoft Defender For Endpoint Exabeam Terraform Azure Threat Hunting Incident Response Automation SOAR MCP LLM

Associate Cybersecurity Analyst

Expeditors

Dec 2020 - Nov 2024 (3 years 11 months)

Engineered and optimized detection use cases in Microsoft Defender for Endpoint, mapped to APT techniques. Conducted threat hunting, led phishing investigations, performed malware analysis, and implemented external attack surface monitoring using Mandiant ASM.

Microsoft Defender For Endpoint Threat Hunting Phishing Analysis Malware Analysis Mandiant Incident Response Penetration Testing