U Debasish Rao

Sole owner of the Information Security program for a fintech API platform serving banking partners and enterprise clients.

• End-to-End Security Ownership: Functioned as the sole security engineer, owning 100% of the InfoSec program, designing, deploying and maintaining cloud and application defenses across all production and staging environments from ground zero.
• Edge & Network Security (AWS WAF & ALB): Architected and configured AWS WAF from scratch to protect mission-critical banking APIs, with custom rate-limiting rules, geo-blocking, bad-bot mitigation and OWASP Top 10 rule groups. Managed Application Load Balancers with SSL/TLS termination, secure cipher suites and hardened traffic routing.
• Continuous Threat Detection & Monitoring: Deployed and operationalized AWS GuardDuty with centralized logging (CloudTrail, VPC Flow Logs) for continuous threat intelligence, automated triage and rapid incident response against anomalous activity.
• SOC & Correlation Engineering: Built the SOC from scratch, centralizing application, AWS WAF, ALB and API gateway logs alongside Linux auditd telemetry. Authored cross-layer correlation rules linking edge, gateway, application and host events, so a single attack chain shows up as one high-fidelity alert instead of scattered signals.
• Bot Defense & Attack Blocking: Deployed TLS fingerprinting (JA3/JA4), bot detection and malicious attack-pattern detection at the edge, successfully detecting and blocking multiple live web attacks and malicious bot traffic against production banking APIs.
• Zero Trust Remote Access: Designed and rolled out a Zero Trust VPN on OpenVPN, enforcing identity-based, least-privilege access to internal and production resources.
• IAM Governance: Conducted comprehensive enterprise-wide IAM audits; enforced the Principle of Least Privilege, removed stale access keys and unused permissions, mandated MFA and rolled out role-based cross-account access controls.
• Compliance & Cloud Hardening: Spearheaded cloud hardening aligned with CIS AWS Foundations Benchmarks, raising security posture scores (AWS Security Hub) across EC2, S3, RDS, networking and containerized workloads to meet fintech compliance requirements.
• Application Security & VAPT: Managed the full vulnerability lifecycle across infrastructure and APIs: ran regular vulnerability assessments, tracked risk remediation with engineering teams and coordinated third-party penetration tests.
• Security Culture & Audit Readiness: Primary technical point of contact for external audits, enterprise client security assessments and banking-partner due diligence.

Protected 500M+ user transactions across PhonePe's distributed fintech platform.

• WAF Strategy & Rule Engineering: Engineered sophisticated rule sets across Cloudflare, Akamai and F5 ASM/AFM, achieving a 45%+ reduction in malicious traffic and significantly lowering false-positive rates for production APIs. Performed continuous threat modeling and defense-in-depth tuning to block OWASP Top 10, bot and zero-day threats.
• In-House WAF Development: Architected and shipped a proprietary WAF leveraging Nginx Ingress Controller, Pingora and Coraza with custom iRules-style logic; achieved a 48% improvement in bot fingerprinting accuracy and hardened the PhonePe CDN against layer-7 attacks. Deployed in Docker containers with automated CI/CD rollout.
• AI-Augmented Alert Investigation: Designed and deployed Barbican, a production MCP (Model Context Protocol) server built on FastAPI, exposing security tools as LLM-callable functions for AI-assisted WAF alert investigation. Integrated an all-MiniLM embedding pipeline with FAISS cosine similarity indexing for semantic deduplication and alert clustering across millions of daily events, cutting L1/L2 mean-time-to-investigate by ~60%.
• SOC Architecture & Detection Engineering: Designed an Elastic Stack-based SOC with SOAR-integrated playbooks that reduced alert noise by 30% and correlation time by 40%; integrated ML-based anomaly scoring to surface high-confidence threats from billions of daily log events.
• Zero Trust & API Security: Established hardened API gateways and edge controls aligned with Zero Trust and defense-in-depth principles; enforced mTLS, rate limiting and bot-scoring at the perimeter for all critical payment endpoints.
• Performance & Scalability: Optimized WAF rule precedence and evaluation order, improving processing throughput under peak load without degrading latency SLAs.

• SOC Architecture & Stack Design: Architect of PhonePe's Security Operations Centre; designed and owned the full detection stack: Elastic Stack (ELK) as core SIEM, Opensearch for log analytics, Wazuh for host-based detection and FIM, QRadar for enterprise correlation, Logstash/Rsyslog for ingestion, Filebeat/Vector as shippers and SOAR playbooks for automated response, handling billions of events per day at 99.99% pipeline availability across 12,000+ systems.
• High-Fidelity Detection Rules: Developed 500+ detection rules mapped to MITRE ATT&CK tactics across network, endpoint and application layers; authored custom Sigma and YARA rules exposing attack patterns previously invisible to existing tooling.
• SIEM Ingestion Pipeline Rebuild: Rebuilt the ELK + Opensearch ingestion pipeline to normalise log schemas from 20+ source systems, enabling consistent cross-source correlation and real-time SOC dashboarding.
• Compliance Automation & Drift Detection: Automated patch compliance for 12,000+ systems using Python, Go and Terraform; delivered hardened OS baselines (RHEL/Ubuntu, Windows) with CIS Benchmarks and drift detection that auto-reverts unauthorized changes, improving measurable compliance posture by 60%.
• Vulnerability Management: Owned the end-to-end vulnerability lifecycle; triaged Nessus/Qualys findings, prioritized remediation using threat intelligence and ensured critical CVEs were resolved within SLA across 12,000+ systems.
• JA4/JA4H Bot Detection: Built a TLS fingerprinting pipeline using JA4 and JA4H signatures that reduced automated abuse on payment APIs by 45% with zero friction for legitimate users.
• Pipeline Security Integration: Embedded SAST, DAST, SCA (Snyk, Trivy) and container scanning gates into Docker-based CI/CD pipelines; enforced OPA policy checks to block deployment of vulnerable code or images.
• Security Telemetry Enhancement: Unified disparate logging pipelines (Filebeat, Rsyslog, Vector) into a single telemetry layer, cutting investigation time by 25%.

Enterprise vulnerability research for Cisco, Juniper, McAfee and other Tier-1 vendors.

• Vulnerability Research (Cisco, Juniper, McAfee): Discovered 70+ critical vulnerabilities through deep Java source code reviews and binary analysis; findings resulted in CVE-credited patches shipped to enterprise customers worldwide.
• VAPT & DAST Tooling: Conducted structured penetration tests using Burp Suite Professional, OWASP ZAP, nmap and Nikto; identified exploitable attack chains in network device firmware and application layers.
• YARA & OVAL Rule Development: Authored 6,000+ OVAL rules and purpose-built YARA signatures for malware classification and firmware threat detection; developed custom SecLang detection logic for proprietary binary formats.
• Workflow Automation: Built Python and Go tooling to automate policy and compliance workflows, cutting manual analyst effort by 60%.

• Server Defense & Hardening: Secured client Linux and Windows environments using ModSecurity WAF rules, IDS/IPS, Rootkit Hunter and custom hardening scripts; implemented CIS Benchmarks for SMB customers.
• Security Training: Delivered technical training in CEH, Security+ and CCNA to 200+ learners with hands-on labs and real-world attack simulation.

Advanced cybersecurity, networking and cloud training in Hyderabad.

• Ethical Hacking & Security Training: Conducted hands-on labs for CEH, ECSA and CISA certifications covering offensive techniques, penetration testing methodology and audit frameworks.
• Networking & Firewall Training: Delivered programs covering WAN/LAN, routing, switching, firewalls, IDS/IPS and AWS cloud basics for students and corporate teams.