Engineering Elite Cyber Defenses & AI-Driven Threat Automation
Hi, I'm Raghav Patel. A Cybersecurity Engineer with 5+ years of battle-tested experience in proactive Threat Hunting, Incident Containment, Detection Engineering, and scaling AI security workflows across 40,000+ customer environments.
Engineering Summary
Cybersecurity Engineer with 5 years of hands-on leadership specializing in Detection Engineering, Proactive Threat Hunting, High-Severity Incident Response, and AI-driven Security Automation at Sophos.
Operationalized threat intelligence across 40,000+ customer environments, systematically reducing false positives and engineering rules directly from post-incident root-cause analysis.
Architected security automation workflows and integrated AI to optimize investigation cycles, slashing manual tasks from full-day efforts (24h+) down to under 30 minutes.
Technical Arsenal & Core Competencies
Detection Engineering & CTH
Cyber Threat Hunting (CTH) based on IOCs, behavioral telemetry, MITRE ATT&CK mapping, and logic tuning on massive live datasets.
AI Security & Automation
Designing AI-assisted investigation workflows, automating SOC playbooks, building Python CLI/GUI tools deployed to 100+ analysts.
Cloud Security & Attack Surface
Sophos Managed Risk launch engineer, Tenable integration, CVSS v3 vulnerability scoring, attack surface reduction, and cloud security posture.
Experience Journey
5 continuous years advancing security engineering at Sophos
Threat Analyst 3
- Lead Incident Responder on escalated and high-severity engagements — orchestrating containment decisions, deep forensic analysis, root-cause investigation, and executive debriefs.
- Post-Incident Detection Engineering: Systematically identify missed attacker behaviors from incidents, author and tune resilient detection logic, and validate across live telemetry.
- Data-Driven False Positive Reduction: Audit noisy rules through rigorous telemetry analysis, ensuring analyst focus is prioritized strictly on high-risk threats.
- AI-Assisted Automation Workflows: Design and deploy AI-accelerated workflows that radically shorten investigation cycles while maintaining uncompromising analytical rigor.
Threat Analyst 2 • Sophos MDR
- Proactive Threat Hunting at Scale: Conducted threat-intelligence and IOC-driven hunts across 40,000+ customer environments within Sophos MDR.
- Central Tool Development: Developed and integrated internal tooling onto Sophos Central that empowered 100+ MDR analysts to drastically reduce investigation overhead.
- Playbook & Query Optimization: Enhanced log correlation queries and playbooks to accelerate cross-source incident triage.
- Led multiple end-to-end security incidents from immediate containment to root cause analysis and mitigation.
Cyber Risk Analyst 2 • Sophos Managed Risk
- Pilot Launch Engineer: Key engineer launching Sophos Managed Risk in partnership with Tenable, taking the service from early access to a multi-million-dollar live offering.
- Pipeline Automation (24h → 30m): Automated vulnerability and attack-surface report processing, cutting manual analysis time from over 24 hours to under 30 minutes.
- MITRE ATT&CK Mapping & Lab Architecture: Mapped vulnerability classes directly to MITRE ATT&CK phases and built reproducible local training labs for analysts.
- Re-engineered the HTML vulnerability reporting engine from CVSS v2 to CVSS v3 scoring and hydrated security data lakes for downstream detection use cases.
Senior Information Security Engineer
- SOC Shift Lead: Led a team of four in 24/7 MDR operations, running threat-intelligence hunts across thousands of customer tenants.
- Built automated workflows improving SOC throughput, response accuracy, and strict SLA compliance; spearheaded multiple code review projects.
Information Security Engineer
- Rapid Automation (30m → 2m): Automated manual posture-improvement workflows in Python within months of joining, and co-built the GUI Asset Discovery tool.
- Authored standard health-check playbooks, trained incoming threat analysts and interns, and contributed architectural inputs for the Account Health Check automated feature.
Honors & Certifications
First Place Winner
Sophos Internal Pacific Thunder CTF 2025
Awarded 1st place in the rigorous Sophos-wide competitive cyber tournament solving advanced incident response, exploit analysis, malware forensics, and attack simulation challenges.
Tenable Vulnerability Management Specialist
Tenable • Enterprise Vulnerability & Risk Management
GitHub Foundations
GitHub • DevSecOps & Repository Architecture
CompTIA CySA+
CompTIA Cybersecurity Analyst
(ISC)² Certified in Cybersecurity (CC)
ISC2 • Information Security Principles
Academic Foundation
Master's in Information Technology
National Forensic Sciences University (NFSU)
Specialized graduate study focusing on digital forensics, cyber intelligence, network defense, telemetry correlation, and system security fundamentals.
Bachelor of Science • IT
Uka Tarsadia University (UTU)
Core computer science foundations, database systems, computer networking, operating systems, security models, and programming.
Let's Connect
Passionate about cutting-edge detection engineering, incident response, AI tooling, and high-impact security architecture.