Kiran Shirali Email & Phone Number

San Jose, Ca, Us

Organization: Security Incident Response, Security Hunting, Security Engineering (Security Detection, Security Automation, Security Analytics and Data Engineering) and Security Problem ManagementCurrently Manage: 2 Security Managers and 2 Security Problem Management Engineers and a total organization of 32 peopleResponsible to ensure that we contain and eradicate any security threat for eBay.

San Jose, Ca, Us

Responsible for: Security Engineering (Security Detection, Security Automation, Security Analytics and Data Engineering)Influence and Adhoc Management: Security Incident ResponseCurrently Manage: 5 Security Analytics and Data Engineers, 4 Security Automation Engineers, 8 Security Detection Engineers.Setup and spearheaded eBay InfoSec's automation program to increase InfoSec's efficiency (Security Incident Response, Vulnerability Response, AppSec Bug Bounty, GRC and Threat Intel). For example, we had a 85% reduction in Mean Time to Resolve Incidents YoY after year one implementation of the automation program. Our workflow automation efforts have achieved a 50% end to end automated security response on all security alerts generated (no human intervention). We have enabled automation for automated evidence collection for myriad of GRC related standard compliance (10+%). We have ensured automated processing of 1k+ indicators influencing our detective and preventative controls. Manage InfoSec's security analytics and data engineering efforts. We are building a custom data engineering logging pipeline and alerting platform leveraging Kafka, Flink and Hadoop to scale to eBay's security needs (currently ingesting daily 25TB+ and counting)Accountable for the detection engineering program for our Security Incident Response team. Manage a team of eight security detection engineers who are responsible for ensuring that our security Incident response team has valuable alarms (and associated investigative data) for bad behavior in our network.Not only is CSIRT my customers, I am also the backup for the CSIRT Manager. I am well versed with handling incidents, dealing with threat intelligence and hunters, engaging with forensic partners, interfacing with legal, communications, brand and treasury teams to build relationships and responding to different audits (internal and external auditors/regulators; ex: PCI, NYDFS)

San Jose, Ca, Us

I currently lead efforts in two logical functions:Detection - Splunk Use Case/Security Content Development• We build intelligent correlation rules on Splunk (our SIEM) to help our Security Operation Center (SOC) get high fidelity alerts so that they can go after malicious entities on systems and networks.• We fine tune the plethora of tools that we have in service to help our detection efforts. Our focus is to improve the true positive percentage for detection tools like Imperva, Netwitness, Tripwire, Data loss Prevention and so on. Fine tuning efforts led to a 11% reduction in manpower costs for the organization for the financial year 2018.Automation - CSIRT Security Orchestration and Automation • We build automated workflows, response and orchestration actions so as to let our analysts be more efficient in their day to day Security Incident Response activities. Implementation of a SOAR setup led to an 87.5% reduction in Mean time to Resolve an Incident.• We also build automated prevention and detection of indicators of compromise by using external threat feeds, there by operationalizing threat intelligence. Also for fun and in the few times that is required, I have jumped into the middle of an investigation to support it both as a technical expert and as a sounding board for analysts to bounce their leads and efforts off.Automation - Vulnerability Management Automation• We build automated workflows for our vulnerability management team, meshing vulnerability findings to asset owners. This allows for a scaled approach of making owners accountable to fixing vulnerabilities in their assets.Purple Team Collaboration: Be a bridge between our Red and Blue team to ensure that there is collaboration and a feedback channel on all activities.

San Jose, Ca, Us

My responsibilities were:• Red team Activities (Simply put, I break into stuff). My targets ranged from the application layer to systems and networks. On a daily basis I was working on a myriad of activities ranging from port scanning subnets using masscan and nmap to extracting passwords from SAM in memory using powershell and mimikatz.• Penetration Test existing applications to catch any security flaws and to get them remediated. I also have performed due diligence penetration tests for potential mergers and acquisitions and have then worked with the business stakeholders (the target's CEO, CTO, Senior Technical and Managerial Staff and so on) to up the security posture.• Coordinated PCI external pentests for eBay for 2016 and 2017. In this role, I had to work with external pentesters and different internal teams in ensuring that all the pentests are performed and issues are remediated to ensure sufficient evidence for the PCI QSA.• Influence building better defensive postures and detection capabilities -- Tested our end point security and perimeter defenses using custom malware built with the help of MSFvenom (Metasploit Tool). -- Engaged the Security command center in bettering their detection use cases based on Red Team exploit kill chains. -- Communicated weaknesses in our defensive posture on a monthly basis to the CTO so as to gain upper management support. -- Coordinated with infrastructure and build teams to harden base images to be deployed for eBay’s external facing applications based on NIST (SP 800-123) standards. -- Conducted companywide awareness sessions on the state of security, successful Red Team exploits and security best practices.

San Jose, Ca, Us

Some part of this role was when I was on PayPal's security team before eBay and PayPal split up to become two different companies. My responsibilities in both PayPal and eBay's security team were:• Build security frameworks so as to enable automated security scans on applications -- Leveraged IBM AppScan Enterprise which is a dynamic application security testing (DAST) tool. -- Enabled automated security scans based on data from existing selenium tests scripts in the Continuous Integration/DEVOPS Model. -- Designed, built and managed the entire AppScan Enterprise set up for eBay and PayPal. Spearheaded all activities from license and server procurement to setup and evangalization of the solution.• Help in efforts to advance security awareness and guidelines among product development teams. -- Incorporated a form of lightweight threat modelling using a tool from Security Compass called SD Elements. -- Ensured that it is baked into the DEVOPS model by automating and integrating the security guidelines system into our internal tools. -- Influenced application architecture designs to incorporate security best practices and standards at PayPal. -- Delivered tailored training sessions to product development teams on security vulnerabilities and their mitigation techniques.• Penetration Test existing applications to catch any security flaws and to get them re-mediated. I also have performed due diligence penetration tests for potential mergers and acquisitions and have then worked with the business stakeholders (the target's CEO, CTO, Senior Technical and Managerial Staff and so on) to up the target's security posture.

Boston, Ma, Us

Was a TA for Foundations of Information Assurance course for the Fall Semester and TA Grader for Cyberspace Programming course for the Spring Semester.

San Jose, Ca, Us

Worked for the Infrastructure QA - AppSec Team. Developed an automation project involving PayPal's Proprietary framework BlueFin (based on Selenium Web driver) and an application security tool IBM AppScan Enterprise.Tested some of the PayPal applications for application security issues before releases went out to production.

San Diego, Ca, Us

For our client Qualcomm,• Led teams to build various desktop and mobile based web applications, using jQuery (and jQuery Mobile) framework, Spring framework (java based web application development framework), HTML5 and JBOSS RESTEasy framework (RESTful web services), for QUALCOMM’s groups. • Performed security assessments to find and eliminate some of the OWASP Top 10 security issues by leveraging proxy tools like Paros and Burp Suite.• Ensured that input sanitization was in place by leveraging OWASP AntiSamy Project and also put in place whitelisting measures.In addition to my technical responsibilities for our client Qualcomm, I was responsible for many additional tasks for Tata Consultancy Services. They are:• Was responsible for security awareness and recent college grad training during their induction to the offshore development center -- Conducted awareness training on OWASP Top 10 attacks, Spring and Hibernate frameworks for RCGs and other laterals when they joined the team.• Was responsible for Tata Consultancy Services' Security Audit Requirements for the Offshore Development Center. -- Coordinated with the Physical Access Team to ensure that physical access to the Offshore Development Center was regulated. Ensured that access reconciliation was carried out on a timely basis. -- Coordinated with the IT Infrastructure team to ensure that logical access to the Offshore Development Computers and Networks was regulated. Ensured that access reconciliation was carried out on a timely basis. Also ensured that associates in the Offshore Development Team are aware and compliant with the Security Policy. Conducted awareness sessions like iSecure and presentations sessions on a quarterly basis to ensure standards of "due care" are met. • Conducted initial screening interviews for freshers and laterals for the Offshore Development Team on topics like Application Security Vulnerabilities, Java, Spring, JavaScript, jQuery and Hibernate.

Master Of Science (Ms), Computer And Information Systems Security/Information Assurance (Information Security)

Bachelor Of Engineering (B.E.), Computer Science