Open to opportunities

Umang Sarswat

@umangsarswat

Message

I’m a red team operator who exposes identity and Tier-0 compromise paths to drive measurable defenses.

India

Message

What I'm looking for

I’m looking to lead assumed-breach red team and adversary emulation work in real enterprise environments, mapped to MITRE ATT&CK. I want roles where I can measure SOC/EDR coverage, run C2-driven threat emulation, and deliver CISO-ready remediation roadmaps with retesting sign-off.

I’m an adversary simulation operator and red team/security consultant with 6+ years breaking enterprise defenses, specializing in Active Directory attack path exploitation and C2-driven threat emulation across Windows AD environments (5,000–20,000+ identities). I hold OSCP, CRTE, and CRTO, and I focus on AD CS abuse (ESC1–ESC8), Kerberos/NTLM/RBCD attack chains, and end-to-end red team lifecycle operations with Cobalt Strike and Sliver.

Every engagement ends with SOC detection coverage analysis, blue team knowledge transfer, and validated remediation sign-off. I consistently uncover domain-level compromise paths that client tooling and SOC detections miss, then translate complex multi-stage attack chains into CISO-level risk narratives and prioritized remediation roadmaps—while actively building Azure AD / Entra ID and hybrid identity red team capability (AZ-900 → AZ-500 in progress).

Experience

Work history, roles, and key accomplishments

Current

Red Team Operator

Current

Aujas Cybersecurity

Sep 2022 - Present (3 years 9 months)

Led end-to-end assumed-breach red team engagements in enterprise Windows AD environments (5,000–20,000+ identities), identifying Tier-0 compromise paths and detection gaps. Delivered Cobalt Strike/Sliver-based MITRE ATT&CK emulations, mapped SOC coverage, and produced CISO-facing risk narratives with retesting-based remediation sign-off.

Active Directory Attack Path Analysis AD CS Abuse (ESC1–ESC8)Cobalt Strike Sliver C2 BloodHound SharpHound DCSync Pass The Hash Pass The Ticket SOC Detection Coverage Testing

Penetration Tester

Gray Hat Security

Jun 2018 - Feb 2022 (3 years 8 months)

Performed full-scope VAPT across web applications, REST/SOAP APIs, and enterprise internal networks, manually chaining OWASP Top 10 and business-logic issues into critical compromise paths. Built Active Directory security assessment capability (privilege escalation, insecure ACLs/trust relationships) and delivered risk-ranked findings and executive remediation roadmaps with validation.

OWASP Top 10 Internal Network VAPT Privilege Escalation & ACL ACE Analysis Burp suite Nmap Nessus Scanning