Cybersecurity Engineer - AppSec & Threat Detection

Talha Khan

US Citizen Plano, TX

*********.*********@*****.*** 469-***-****

Professional Summary

Cybersecurity Engineer with 6+ years of experience in enterprise security engineering, application security testing, vulnerability assessment, threat detection, and incident response. Hands-on experience with Burp Suite, OWASP ZAP, Nessus, Qualys VMDR, Metasploit, AWS, Azure, Docker, and Kubernetes. Experienced in identifying security vulnerabilities, assessing application and infrastructure risks, supporting remediation efforts, and strengthening enterprise security controls. Knowledge of secure software development practices, application threat modeling, cloud-native security, and security assessment automation. Skilled in collaborating with engineering, infrastructure, and security teams to improve security posture and support risk-based remediation.

Technical Skills

Endpoint Security: CrowdStrike (EDR, NextGen SIEM, Endpoint Firewall, USB Device Control, Identity Protection), SentinelOne, EDR, Palo Alto XDR, Microsoft Defender, and Rapid7 InsightIDR.

Operating Systems: Windows Client, Windows Servers, Linux Servers (Ubuntu, SUSE, Kali Linux, CentOS, RHEL), Machintosh.

Application Security: Web Application Security Testing, OWASP Top 10, API Security Testing, Authentication and Authorization Testing, Secure Code Review, Vulnerability Validation, Security Remediation.

Cloud-Native & Supply Chain Security: AWS Security, Azure Security, Docker, Kubernetes, Container Security, Dependency Vulnerability Assessment, Software Supply Chain Risk Assessment.

Cyber Security Tools: Burp Suite, Wireshark, Tenable Nessus, Rapid7’s MetaSploit, Nexpose, And Qualys VMDR.

Penetration Testing & Vulnerability Assessment: Burp Suite, Nmap, Rapid7 InsightVM, Nessus, OpenVAS, Checkmarx, Veracode, OWASP ZAP, HP Web Inspect, SQL MAP, Metasploit.

Cloud: AWS (EC2, S3 bucket, VPC, Security Groups, LightSail), Azure (Entra ID, VM, Networking), Microsoft (Intune, Defender), Kubernetes, Docker.

Education:

BSCS – Iqra University

Work Experience

Citibank April 2022 – Present

Cybersecurity Engineer

Responsibilities:

Deployed CrowdStrike Endpoint Detection and Response (EDR) solutions to safeguard enterprise environments, ensuring enhanced endpoint protection and threat visibility.

Developed and integrated CrowdStrike EDR, Firewall and Identity Protection solutions to enhance organizational security against advanced threats.

Conducted security assessments and vulnerability testing using tools such as Burp Suite, Nessus, Qualys VMDR, and Rapid7, documenting findings and supporting remediation activities.

Collaborated with infrastructure, application, and security teams to assess vulnerabilities, evaluate risk, and prioritize corrective actions based on severity and business impact.

Configured and optimized App-ID, User-ID, and Content-ID profiles to gain granular visibility into network traffic, effectively reducing the corporate attack surface.

Designed and maintained secure URL Filtering, WildFire malware analysis, and Threat Prevention profiles to block advanced persistent threats (APTs) and zero-day exploits.

Supported identity and access management across Azure Entra ID and AWS IAM, helping secure user access, cloud resources, and enterprise security environments through access controls and security policies.

Monitored and investigated identity-related security events and access risks using Microsoft Sentinel, Splunk, Intune, and endpoint security tools, applying threat-hunting and incident-response practices to identify and remediate suspicious activity.

Contributed to security governance, risk assessment, audit, and compliance activities, documenting security controls, vulnerabilities, findings, and remediation actions while collaborating with cross-functional teams to maintain secure access and infrastructure.

Conducted red teaming exercise, simulating attacks to identify vulnerabilities, and improve overall security measures.

Mitigated enterprise risk by utilizing automated tools to rapidly locate and purge spoofed messages from user inboxes, reducing the threat blast radius and response time.

Developed and executed structured threat hunting hypotheses utilizing the MITRE ATT&CK framework to detect advanced persistent threats (APTs) and lateral movement that bypassed perimeter defenses.

Performed incident response by leveraging Intune device logs and integration with SIEM platforms like Splunk and Sentinel.

Deployed and tuned Symantec Data Loss Prevention (DLP) network discover scan to identify sensitive data at rest, in motion, and in use across enterprise infrastructure.

Engineered and managed comprehensive vulnerability management workflows using Tenable Nessus, Qualys VMDR, and Rapid7 Nexpose to discover and remediate infrastructure blind spots.

Implemented DAT file and signature updates through ePO to ensure continuous protection against emerging threats.

Automated incident response workflows using Splunk SOAR (Phantom) to isolate compromised endpoints and generate tickets in ServiceNow.

Worked on configuring on-access and on-demand scans with McAfee Antivirus to detect and remediate threats.

Designed and secured AWS infrastructure, implementing strict Security Groups, Network ACLs, and IAM policies across VPCs, EC2 instances, and S3 buckets.

Delivered extensive post-deployment assistance, guaranteeing flawless EDR system setup.

Worked on Kali Linux to perform authorized internal penetration testing, vulnerability exploitation, and network security assessments.

Collaborated with cross-functional teams to create robust security frameworks, reducing response time to incidents, and improving the resilience of critical infrastructures.

Texas Human Health May 2020 – March 2022

Security Engineer

Responsibilities:

Deployed CrowdStrike EDR and Cloud Security Modules (including container and Kubernetes environments) to secure enterprise infrastructures, enhancing endpoint protection and cloud security.

Conducted vulnerability assessments using Rapid7 Nexpose, enhancing risk detection.

Performed red teaming exercise to identify system weaknesses and improve security posture.

Implemented High-Availability, URL filtering, SSL Decryption, Palo Alto Global Protect for VPN clients, layers 4-7 policies, User-ID using LDAP, App-ID, Threat Prevention, Autofocus with Mine integration, Zone Protection, DNS Sinkhole and Wildfire configurations.

Worked on multiple RSA Archer solutions i.e. Business Continuity, Compliance, Audit, Policy, Risk and Vendor Management, including Findings and Issues Management, Risk Register, Risk Control Self-Assessment and Security Operations.

Troubleshot issues on all Platforms, threat remediation on Splunk Agent, VirusScan Enterprise (VSE), ENS, and MNE.

Worked closely with cross-functional teams to design and implement effective network security measures, ensuring that policies were well-documented and aligned with organizations standards to maintain clarity and compliance.

Deployed and configured Nessus for comprehensive vulnerability scanning and remediation planning.

Worked on Metasploit for penetration testing, identifying and addressing critical security gaps in enterprise networks.

Contact this candidate