About

Who I Am

I’m a Security Engineer focused on detection engineering, AI security, and security automation — 12+ years spanning enterprise systems engineering, security operations, incident response, and forensic analysis.

I build automated threat-disruption and containment workflows, secure enterprise LLM integrations against prompt injection, and develop AI-assisted security investigation pipelines. The through-line across my career: trace problems through complex, multi-component systems and ship controls that work under production stress — not just in theory.

Currently Security Engineer — Detection & AI Systems at Wrike (May 2026–present). Previously Detections and Response at Atlassian (2024–2026), with a decade before that in enterprise technical support and escalation engineering at Atlassian and Dell EMC.

Professional Experience

Wrike — Security Engineer, Detection & AI Systems

May 2026 – Present

AI Security & Prompt Injection Defense: Designed a least-privilege Model Context Protocol (MCP) server integrating Rapid7 InsightIDR and Surface Command with LLM-driven security investigations. Built trust boundaries around untrusted telemetry so fields like User-Agent strings cannot be interpreted as model instructions — while preserving original forensic data.
LLM-Aware Detection Pipeline: Developed a recursive payload scanner to identify prompt-injection content in security telemetry and inject security warnings into model context. Validation controls block autonomous investigation closure when adversarial content is detected; human analyst approval is required.
Shadow AI Threat Hunting: Led a proactive hunt across enterprise endpoint telemetry for unauthorized and high-risk AI usage. Identified ~500 instances of potentially risky activity; presented findings to senior leadership, driving proxy-level blocking and enterprise AI governance changes.
Automated Containment: Designed fault-tolerant containment workflows in Rapid7 InsightConnect across Okta, Google Workspace, Jamf, Microsoft Defender, and Rapid7 — endpoint isolation and identity lockdown with API error handling and state synchronization.

Atlassian — Security Engineer, Detections and Response

Mar 2024 – Mar 2026

AI-Assisted Phishing Triage: Built a data-sovereign LLM triage pipeline in Jira to classify employee-reported phishing without external vector databases. Incorporated analyst-verified resolutions into subsequent investigations; automated closure of ~80% of benign reports while escalating high-confidence malicious submissions.
Automated Threat Disruption: Designed a Tines/Splunk pipeline to detect and dismantle SaaS phishing campaigns abusing Atlassian infrastructure. Combined behavioral signals, account age, and domain reputation with AI-assisted verdicts — 1,700+ malicious entities removed.
Malware & Repository Abuse Response: Automated investigation of malicious Bitbucket repositories — isolated cloning, LLM-assisted static analysis, confidence-based remediation and takedown.
AI Security Architecture: Identified risks from exposing raw malicious payloads to LLM analysis; established architectural requirements separating untrusted code and telemetry from model-driven decisions.

Atlassian — Senior Escalation Engineer, Enterprise Support

Sep 2018 – Mar 2024

Investigated high-severity failures across distributed cloud and on-premise systems — application behavior, OS telemetry, networking, storage, authentication, and resource utilization.
Led complex escalations involving Kubernetes, Linux, databases, and enterprise integrations; translated low-level findings into actionable remediation for engineering and leadership.
Built automated investigation workflows in Tines and operational playbooks for security, legal, HR, and insider-threat investigations.

Dell EMC — Senior Analyst, Enterprise Technical Services

Jul 2013 – Sep 2018

Root-cause analysis of enterprise distributed storage (Isilon NAS) — Linux, NFS/SMB, networking, kernel behavior, and protocol-level failures at petabyte scale.
Developed deep expertise in log analysis, system telemetry, network traces, and multi-layer incident isolation.

The Adversarial Analyst

Outside production work, I run The Adversarial Analyst — a YouTube channel for hands-on AI security research and forensic case studies.

Each lab walks through a real vulnerability class from the OWASP Top 10 for LLM Applications — prompt injection (LLM01), insecure output handling (LLM05), and related trust-boundary failures — with the same rigor I apply in enterprise detection engineering:

Hands-on exploit labs with reproducible Python applications and step-by-step attack demonstrations
Forensic case studies analyzing data flow, attack chains, and root cause for AI-integrated applications
Companion tooling — log analysis scripts, mock SOC evidence (server logs, telemetry), and remediation examples
Trust-boundary analysis — mapping where untrusted input crosses into model context, tool execution, and downstream systems

All lab code, artifacts, and walkthrough materials live in the open-source OWASP LLM Lab repository. The channel and this blog complement each other: videos show the exploit path and forensic narrative; write-ups here document the production-scale defense architecture.

Projects & Open Source

Project	Description
OWASP LLM Lab	Hands-on OWASP LLM Top 10 labs, exploit demos, forensic artifacts, and zero-trust remediation examples
Distributed AI Malware Analysis Engine	gVisor-isolated static analysis (Semgrep, YARA); LLMs restricted to enrichment, not primary detection
Autonomous Phishing & Local VLM Triage	Headless browser detonation + local VLM verdicts in under 60 seconds
Plaso DFIR Framework	Upstreamed Jira/Confluence Data Center log parsers — PRs #5030, #5043

Education & Certifications

Master of Technology (Software Engineering) — Birla Institute of Technology and Science (BITS), Pilani

Bachelor of Computer Applications — MS Ramaiah College of Arts, Science & Commerce, Bengaluru

Certifications: AWS Certified Security – Specialty · AWS Solutions Architect – Associate · Databricks Certified Data Engineer Associate · Tines Core Certified · CompTIA Security+

How I Think About Security Engineering

Untrusted data should be visible, labeled, and scored — not amputated.

My support background means I optimize for production reality: controls that survive messy telemetry, analyst workflows that do not drown in false positives, and automation that fails closed when confidence is low. The Adversarial Analyst labs exist for the same reason — you cannot defend a trust boundary you have never broken.

Writing on This Site

This blog documents hard problems from production work — indirect prompt injection in SIEM telemetry, why regex-strip fails as LLM defense, validating detection pipelines for AI-assisted SOC tooling, and multimodal phishing triage. Less tutorial, more “here is the threat model and what we shipped.”

Get in Touch

“Detection engineering for the LLM era — where your telemetry is the prompt surface.”