Felix Mehta Email & Phone Number

London, Gb

London, England, United Kingdom

- Architecting and developing internal tools instrumental in evaluating and testing the performance of Windows memory scanners and anomaly detection systems, contributing to the testing and continuous improvement of the product.- Spearheading a diverse range of projects with a focus on MacOS detection engineering, leading sprints that encompass emulating both real world MacOS killchains as well as testing for generic coverage of malicious techniques.- Orchestrating and directing comprehensive purple team engagements, focused on identifying and bridging detection and telemetry gaps in our MacOS agent and Windows memory anomaly detection engine, bolstering coverage with continuous detection improvement.- A core contributor and curator of an extensive detection rule repository, now encompassing over 7,000 nuanced rules, providing wide-ranging coverage across Linux, Windows, Mac, and Cloud environments.- Taking part in (and winning) a company wide internal hackathon with a machine learning PoC project designed to help improve our detection fidelity and reduce false positive alerts.

London, England, United Kingdom

- Dealing with and leading real world incidents spanning low-level actors to organised crime to APT, working forwards and backwards to both find infection vectors and provide information on the latest activity before working directly with clients to build and execute comprehensive remediation strategies from standard persistence removal to full domain compromise recovery.- Proactively hunting for malicious activity on customer estates following the scientific method to refine and target potentially malicious/suspicious activity.- Actively investigating and analysing modern day malware campaigns, TTPs and payloads using a mix of EDR and reverse engineering tools to check coverage and build new detection rules/methods.- A core contributor and maintainer of a detection rule repository with over 2,000 rules covering Linux, Windows, Mac and Cloud with many notable, high fidelity rules for detecting C2 activity.- Actively participated in knowledge sharing for many internal teams which included multiple presentations on Windows and Malware internals, writing comprehensive documentation for internal offensive toolkits as well as personally mentoring newer members of the team.- Taking on large research projects such as re-creating APT malware Siloscape and its Windows container breakout exploit in an attempt to find methods of detecting malicious activity involving the Windows Object Manager and symbolic link abuse.

United Kingdom

- Built a full stack client facing automated security assessment dashboard. This allowed consultants to directly write their testing reports into an application which could then be shared directly with clients. This application had many features to improve the quality of life for consultants such as integration with our knowledge base to paste snippets and automatic document sanitizing.- Performed and assisted in web app, mobile and API security assessments which involved assisting senior consultants in real world engagements.- Managed and maintained internal tooling. This included fixing bugs and adding features to both our client facing security portal and our internal knowledge base application.- Setting up and administrating internal ESXI servers. Our applications were all hosted on site and were deployed as virtual machines in an ESXI instance.

Bsc. (Honours) Computer & Information Security, Computer Science, First Class Honours (79%)

Activities and Societies: Member of SHU Ethical Hacking SocietyDissertation: "Efficiency & Implementation Viability of x86 Anti-Debugging.

Level 3, Software Development, Triple Distinction