Vishwamurti Purushottam

• Performed day-to-day security operations, including vulnerability assessments, patch

management, and incident response, while managing AWS resources (EC2, RDS, S3,

ALB, Lambda, IAM) with a focus on security and scalability.

• Developed and maintained ISMS frameworks aligned with ISO 27001 and SOC2,

achieving zero audit findings for four consecutive years.

• Conducted annual risk assessments, compliance audits, and third-party vendor

evaluations, identifying gaps and recommending mitigation strategies.

• Automated CIS control deployment for AWS environments and production hardware,

leveraging Python, Ansible, and Pulumi IaC to ensure compliance and security.

• Streamlined user lifecycle management and patch management using AWS Systems

Manager (SSM), while automating JFrog key rotation to enhance supply chain security.

• Refactored Github Dependabot workflows to parse alerts and auto-generate JIRA

tickets using AWS Lambda and RDS, streamlining vulnerability management.

• Implemented AWS Config rules, SCPs, and centralized CloudTrail logging to enforce

compliance and establish guardrails across accounts.

• Built an LLM-powered inference server to automate vulnerability tracking and

communication, aligning remediation with corporate policies.

• Integrated security tools (SAST/DAST) into DevOps pipelines, automated AWS WAF

responses, and utilized ELK and Lacework for proactive threat detection and response.

• Conducted manual web application penetration testing with tools like Burp Suite and

OWASP ZAP to validate and remediate vulnerabilities.

• Authored 44 information security policies and detailed compliance reports to

strengthen organizational security and ensure regulatory adherence.

• Created comprehensive Confluence documentation to standardize processes and

improve knowledge sharing across teams.

• Delivered OWASP Top 10 training sessions, cultivated a security-first culture through

impactful employee programs.

• Spearheaded real-time incident response platforms integrating The Hive, Wazuh IDS,

and Cortex, and proactively addressed high-priority incidents.

• Continuously monitored security trends and exploits, ensuring defenses were updated to mitigate emerging threats.

• Leveraged Splunk's machine learning toolkit to identify unauthorized access to PHI and developed custom use cases to detect privacy breaches, phishing, ransomware, and malicious behavior.
• Automated incident response workflows using Splunk Phantom, improving response times and efficiency.
• Conducted internal penetration testing to uncover vulnerabilities within the PCI zone and performed forensic analysis on flagged devices using Encase and CrowdStrike Falcon.
• Configured McAfee MVISION Cloud to streamline log collection and ingestion processes across the organization.
• Trained IT security interns on network security principles and the effective use of Splunk for threat detection and response.

• Inspected and assessed healthcare information systems, security controls, and
operational processes for compliance with corporate policies and regulations.
• Conducted audits across various computing environments, identifying risks,
interpreting results, and documenting findings against defined criteria.
• Performed network penetration testing and recommended controls aligned with SOC2
and HITRUST standards to enhance the organization's security posture.