Experience | Ravi Sarode

Tactical Threat Analyst 2 (MDR)

Current

May 2023 – Present

Managed Detection and Response (MDR) · FortiEDR · Monitoring · Threat hunting · Incident response

Work as part of Fortinet’s MDR team, monitoring FortiEDR alerts across customer environments and investigating suspicious activity on endpoints.
Handle alerts end to end in FortiSOAR — reviewing the activity, filtering out false positives, and escalating confirmed threats to customers with clear findings and recommended actions.
Investigate endpoint incidents by tracing process trees, command lines, parent-child relationships, and other available telemetry to understand what happened and determine the scope of the activity.
Respond to confirmed threats by isolating affected endpoints, stopping malicious processes, removing persistence, and supporting customers through remediation.
Perform threat hunting across customer environments using threat intelligence, new IOCs, and known attacker techniques to identify activity that may not have triggered existing detections.

Apr 2021 – Apr 2023

Microsoft Defender for Endpoint · Threat detection · MITRE ATT&CK

Worked on Microsoft Defender for Endpoint, investigating customer alerts and checking whether the activity was malicious or a false positive.
Used KQL to search and analyze customer events, endpoint activity, and related telemetry during investigations.
Handled high-priority security cases with strict SLAs, where investigations had to be completed within a few hours.
Created suppression rules in Defender for known legitimate activity to reduce repeated false-positive alerts.
Wrote and tested detection rules to identify suspicious activity and generate alerts for specific behaviors.

Feb 2020 – Oct 2020

Cybersecurity fundamentals · Networking · IAM · Scripting