Durgesh Gaurav

Key Responsibilities:

• Directed end-to-end intelligence lifecycle operations covering adversary research, all-source collection, IOC lifecycle management, campaign analysis, and finished intelligence dissemination to SOC, DFIR, detection engineering, and C-suite stakeholders across 5+ concurrent threat domains.
• Architected automated ETL pipelines for data ingestion, enrichment, normalization, and operationalization. Consolidating commercial feeds, OSINT, dark web, partner sharing, and internal telemetry into a single intelligence workflow, materially reducing analyst manual workload and accelerating time-to-detection.
• Identified AI security and quantum security as critical unaddressed threat domains; recommended formalizing both as dedicated research functions and built them from scratch using MITRE ATLAS, NIST AI RMF, and OWASP for LLM as the analytic foundation.
• Established 3 formal external intelligence-sharing partnerships; coordinated information sharing with public and private sector partners, ISACs, and government contacts to expand collective threat visibility.
• Integrated LLM-augmented pipelines into collection, enrichment, and report generation workflows; served as internal SME for AI-driven intelligence operations, cutting report production time significantly and improving analytic throughput.
• Authored and delivered executive-level threat intelligence briefings and all-source intelligence reports to C-suite, legal, and operational stakeholders; maintained intelligence knowledge bases tracking multiple adversary TTP profiles, detection coverage gaps, and mitigation recommendations.
• Mentored analysts on structured analytic techniques, intelligence tradecraft, and report production standards; assessed, onboarded, and governed CTI platforms and threat intelligence data products to continuously improve program maturity.
• Directed threat hunting missions and incident support operations, pivoting across network, log, and endpoint telemetry to investigate ransomware campaigns, APTs, and targeted attacks; provided intelligence context to responders in near-real time.

Key Responsibilities:

• Researched and developed system(s) to capture active zero-day threats and assess adversary latest TTPs.
• Monitored Dark/Deep web for sensitive information, adversary activities, and potential threats to infrastructure.
• Leveraged MITRE ATT&CK, Diamond, Pyramid of Pain, Cyber Kill Chain, and related models for threat investigations.
• Hunted, investigated, and identified IOCs and IOAs to identify threats and threat actor TTPs in the environment.
• Helped improve threat detection by providing latest adversary TTPs to relevant stakeholders.
• Leveraged OSINT, SMI/SOCMINT, and TECHINT solutions to obtain and investigate intelligence.
• Conducted threat emulation and simulation to identify security gaps and remediated security issues.
• Identified infection/attack vectors and assessed impact of intrusions.
• Performed incident identification and triage and provided response to incidents.
• Developed Digital Forensics, Network Forensics, and Incident Response plans and procedures and performed incident investigations.
• Identified, collected, and analyzed digital evidence and conducted investigations on security incidents.
• Performed malware analysis and analyzed threat capabilities.
• Analyzed malicious traffic and IOCs to perform correlation to attribute threat actors.
• Researched, analyzed, and provided reports on attacker campaigns as required.
• Wrote YARA and Sigma rules.
• Managed and consolidated cyber threat data sources, compiled reports, and provided regular consultation and threat briefings to stakeholders.
• Tested and analyzed vulnerabilities reported in Fortinet products and assessed the impact of the vulnerabilities.

• Engineered enterprise software applications using Java SE, JSP, Hibernate, and MySQL backend systems.