Jeet A Pandya

Rajah & Tann Singapore

Cybersecurity Operations Manager

2025 – Present

Security Operations AI Security Tooling Vulnerability Management EDR DLP MSSP Management Incident Response Cloud Security Secure Configuration

Manage and operate day-to-day security tooling including vulnerability management, Data Loss Prevention (DLP), and Endpoint Detection & Response (EDR) platforms across the organisation.
Act as service manager for external Managed Security Service Providers (MSSPs) — defining service expectations, reviewing performance, and ensuring quality of alert triage and escalation processes.
Investigate and triage security alerts including phishing, DLP incidents, and MSSP-raised events, determining scope and coordinating response accordingly.
Define and evaluate secure configuration baselines across SaaS, cloud (Azure), and on-premises environments including Active Directory, Microsoft 365, Entra ID, and Intune.
Building an AI agent for the security team focused on cybersecurity operations — exploring how LLM-based automation can support alert triage, investigation workflows, and security reporting.
Respond to and manage security incidents to minimise organisational impact, working closely with IT and business stakeholders to contain and remediate effectively.
Report directly to the Chief Information Security Officer (CISO), contributing to strategic security planning alongside operational responsibilities.

KPMG Singapore

Assistant Manager → Manager | Cyber Security Advisory

June 2023 – 2025

Incident Response Threat Hunting Digital Forensics SOC Assessment Use Case Development Purple Team Cloud Forensics IT/OT Security

Led ransomware and data loss incident response investigations on Windows, Linux, and Cloud environments — identifying full attacker footprint and data exfiltration scope for multiple enterprise clients.
Directed Business Email Compromise (BEC) investigations for multiple clients, encompassing log analysis, email forensic artefact analysis, and delivery of comprehensive incident reports.
Supported PDPC-compliant data breach investigations for Singapore-based organizations, including PII data classification, impact scoping, and regulatory reporting assistance.
Performed security compromise assessments across telecom and financial services sectors using network traffic analysis, endpoint security tooling, and historic data analysis from triage collection.
Supported compromise assessment for a property and hospitality group — analysing servers, endpoints, network traffic, and applications across all properties for indicators of suspicious behaviour.
Led threat hunting in IT/OT environment for a natural gas manufacturer, analysing key servers, networking devices, security tools, and DNS infrastructure.
Led blue team operations during purple team cloud exercises, focusing on TTP-based cloud detection and response across the MITRE ATT&CK matrix.
Conducted SOC maturity assessment for a large insurance company — delivering gap analysis, target-state recommendations, and peer benchmarking across Governance, People, Process, and Technology.
Developed prioritised use cases and attack path models for Web, SAP, and IoT applications for an investment trust organization based on threat assessment and attack path modelling.

Ernst & Young Singapore

Senior Consultant | Cyber Security

Dec 2021 – Mar 2023

Next-Gen SOC SOC Audit Tabletop Exercise Cyber Due Diligence Insider Threat

Designed and developed Next-Gen SOC architecture for a transformation strategy — converting a traditional SOC to a more mature, robust state, and implemented a reference demo environment to operationalize the vision.
Led and executed a Security Operation Centre internal audit for a commercial MSSP, presenting findings across Governance, People, Process, and Technology dimensions, and identifying non-compliance areas and improvement opportunities.
Developed threat scenarios and executed tabletop exercises — providing technical knowledge support, building storyboards, designing injects, and facilitating the exercise for client stakeholders.
Conducted cyber due diligence for a financial services M&A transaction — providing pertinent insights into the target's cyber security governance, policy, and strategic posture.
Developed insider threat detection use cases for a financial services organization — mapping real-world insider threat scenarios to detection logic and SIEM alert design.

Ernst & Young Chennai

Intern → Associate Consultant → Consultant

Jul 2016 – Apr 2021

Compromise Assessment SIEM Engineering Splunk Architecture MITRE ATT&CK AWS Deployment SOC Operations

Led a real-time compromise assessment for a global omnichannel BPO — deploying Splunk and OSQuery agents across worldwide data centres, implementing SPAN mirroring of internet gateway traffic, and performing deep packet, domain, and traffic analysis.
Led threat hunting teams for manufacturing and telecom firms in India — developing hypotheses, mapping TTPs to MITRE ATT&CK, identifying log sources, and performing log analysis across network and endpoint security devices.
Designed and developed advanced Splunk threat detection use cases for a large payments organization — building SPL queries, correlation logic, alert notification templates, and custom dashboards.
Architected and deployed Distributed Splunk on AWS using Docker containers — configuring Indexer Clusters, Search Head Clusters, Heavy Forwarders, Deployment Server, Deployer, and Distributed Monitoring Console for high availability and scalability.
Led SOC operations with CI/CD pipeline for continuous Splunk use case deployment — including Splunk Enterprise Security and Alert Manager, with integrated Threat Intel and TAXII feed ingestion.
Crafted MITRE ATT&CK frameworks for Enterprise and AWS environments across ride-hailing, manufacturing, and media clients — mapping use cases, identifying detection gaps, and building coverage to strengthen overall security posture.
Deployed an in-house SOC for an agricultural organization — covering SIEM architecture planning, risk assessment, asset inventory, log onboarding, use case development, custom Splunk app creation, dashboard design, automated reporting, and analyst training.
Performed Splunk integrations for News and Oil & Gas organizations — from server hardening and device onboarding through to alert creation, index design, and dashboard deployment.

Profile Summary

Professional Experience

Certifications & Achievements

Verify All Credentials on Credly

Skills & Expertise

CORE COMPETENCY PROFICIENCY

Education & Foundation

Life Outside the SOC