Looking for a job

Rakesh Mishra

@rakeshmishra6

Security Director at Microsoft securing Microsoft 365 with end-to-end Assume Breach services across Teams, Exchange, and SharePoint.

India

Message

At Microsoft, I provide end-to-end Assume Breach services for Microsoft 365, including threat detection engineering, security research, incident response, and adversary emulation. I established the team at Microsoft IDC to support security operations for Microsoft 365 services.

Previously, I built offensive security and threat hunting capabilities at Microsoft, including adopting MITRE ATT&CK to increase detection coverage by 50%. At AWS, I expanded the Dublin Cloud Security Response team and developed an incident response process for a range of security scenarios.

Experience

Work history, roles, and key accomplishments

Current

Director of Security, M365 Security Engineering

Current

Microsoft

Apr 2024 - Present (2 years 7 months)

Provide end-to-end Assume Breach services for Microsoft 365 services, leading a team of 35+ FTEs and 10+ vendors. Established the team from the ground up to secure over 10 million servers and thousands of Azure tenants.

Threat Detection Engineering Security Research Platform Development Incident Response Adversary Emulation Data Science AI Microsoft 365 Azure

Manager, Cloud Security Response

AWS

Mar 2023 - Apr 2024 (1 year 1 month)

Expanded the AWS Dublin team from 4 to 25 FTEs, building a dedicated group for security incident response. Developed and implemented a comprehensive incident response process covering vulnerability remediation, attack mitigation, forensic analysis, DDoS response, and supply chain security.

Incident Response Vulnerability Remediation Forensic Analysis DDoS Response Supply Chain Security Team Leadership

Security Engineering Manager

Microsoft

Oct 2021 - Mar 2023 (1 year 5 months)

Led a world-class Offensive Security Practice encompassing Application Security, Purple Team, Adversary Emulation, Threat Modelling, and Offensive Security Research. Pioneered and built the practice from inception at Microsoft IDC, employing a data-driven approach to scale offensive security operations.

Offensive Security Application Security Purple Team Adversary Emulation Threat Modeling Data Driven Security

Security Engineering Manager (MSRC)

Microsoft

Dec 2018 - Sep 2021 (2 years 9 months)

Led a world-class security monitoring team delivering 24/7 monitoring, analysis, and investigation of abnormal activities. Established the threat hunting function from scratch and directed Purple Team engagements, managing high-impact incidents like Log4J and SolarWinds.

Security Monitoring Threat Hunting Detection Engineering Incident Response Purple Team Data Science Log4j Solarwinds

Senior Security Engineer (MSRC)

Microsoft

Sep 2015 - Dec 2018 (3 years 3 months)

Spearheaded adoption of MITRE ATT&CK framework, improving detection coverage by 50%. Developed Jupyter Notebooks based Investigation Framework, reducing time to investigate by 20%, and served as Product Owner for a proprietary SIEM solution.

MITRE ATT&CK Detection Engineering Jupyter Notebooks SIEM Threat Hunting Ransomware Cobalt Strike

Security Specialist

Markit

Jan 2015 - Sep 2015 (8 months)

Joined as the first member of the information security team and collaborated with the CISO to establish a comprehensive security compliance program. Developed and implemented a robust vulnerability management process and deployed critical security tools.

PCI HIPAA ISO 27001 Vulnerability Management Zscaler Avecto Privilege Guard Algosec

Senior Security Engineer

Symantec

Apr 2013 - Jan 2015 (1 year 9 months)

Managed security incidents and conducted log analysis across multiple devices including Snort IDS/IPS, ISS IPS, firewalls, SEP, antivirus, FireEye, and Palo Alto. Conducted in-depth analysis of malware samples and prepared executive summaries and threat reports.

Incident Response Log Analysis Snort ISS IPS FireEye Palo Alto Malware Analysis Threat Intelligence

Security Engineer

NIIT Technologies

Feb 2011 - Apr 2013 (2 years 2 months)

Deployed and managed SIEM solutions including ArcSight ESM and Logger, developing use cases, rules, reports, and dashboards. Conducted triage of phishing emails and security alerts, and collaborated with auditors for compliance.

ArcSight ArcSight Logger SIEM Use Case Development Phishing Analysis PCI ISO 27001