Nitin Maurya

Cyber security architect

Security architecture and SOAR automation for banks and telecoms, from New Delhi.

Email Nitin Download CV (PDF)

10+ years

  1. 2015 Canara Bank
  2. 2016 Punjab National Bank
  3. 2023 British Telecom
  4. 2026 now

Now. At British Telecom I design, build and tune security automation for managed security customers in banking, telecom and enterprise: SIEM, SOAR, firewall, proxy and incident response.

Before. Seven years at Punjab National Bank, where I led the SOC amalgamation of three PSU banks after the government merger and answered to the RBI and CERT-In.

How I work. I turn business requirements into technical deliverables and explain them to C-level stakeholders and regulators, on premises and in Azure and AWS. Write to me about your SOC.

Based in
New Delhi, India
Role now
Cyber Security Architect & Automation Consultant, British Telecom
Sectors
Banking, telecom, enterprise
Regulators worked with
RBI, CERT-In

ZeroOps incident response

How alerts move through a British Telecom customer SOC without an analyst touching them.

Diagram of the ZeroOps pipeline: ingest, SIEM, triage, enrichment, then auto-close for benign alerts or approved containment for malicious ones. 90% of alerts need no manual intervention. No manual intervention for 90% of alerts IngestSyslog, webhook SIEMSentinel, NetWitness TriageCortex XSOAR EnrichAnomali, VirusTotal,Unit 42, OpenAI Benignclosed automatically Maliciouscustomer approves, thenCrowdStrike RTR contains DWG 01, ZeroOps IR, British Telecom, 2023 to now Diagram of the ZeroOps pipeline: ingest, SIEM, triage, enrichment, then auto-close or approved containment. 90% of alerts need no manual intervention. 90% of alerts, no manual step IngestSyslog, webhook SIEMSentinel, NetWitness TriageCortex XSOAR EnrichAnomali, VirusTotal,Unit 42, OpenAI Benignclosed automatically Maliciouscustomer approves, thenCrowdStrike RTR contains DWG 01, ZeroOps IR

Work, by employer

What was built and what it changed, newest first.

No.WorkResult
British Telecom eServe India Cyber Security Architect & Automation Consultant Apr 2023 to now
01ZeroOps incident responseManual intervention removed for 90% of alerts, cutting MTTA and MTTR
02Modular SOAR playbooks10+ monolithic playbooks rebuilt as modules, 30% less SOAR resource use
03SIEM EPS reduction30% less EPS load through log filtering and normalisation
04MITRE ATT&CK detections20+ rules mapped to tactics and techniques
05AI incident enrichmentOpenAI adds context to each incident for the analyst
06Shadow AI securityDetection and auto-remediation of unsanctioned LLM use (OpenRouter, QwenCode) with CrowdStrike
07Approval-gated remediationCustomer-authorised automated response for critical incidents
08Caldera adversary emulationDetection rules validated and coverage gaps closed
09Custom integrationsProofpoint Threat Response, Zscaler ZPA, Sonatype Nexus, Strata Cloud Manager; 2 features shipped out of the box
Punjab National Bank Senior Manager IT (Cyber Security) Jul 2016 to Apr 2023
10PSU bank SOC amalgamationSOCs of PNB, Oriental Bank of Commerce and Union Bank of India unified; a 10+ member team led
11Banking detection use casesInternet and mobile banking, UPI, IMPS, SWIFT, CBS, CTS, RTGS, NEFT
12Cortex SOAR rolloutAutomated incident response workflows
13Regulatory complianceRBI audits; security posture reported to CXO strategy committees
1424/7 incident response100% SLA compliance; IPS monitoring and DDoS mitigation
15CERT-In red team exercisesInfrastructure deployed; threat intelligence shared with national cyber bodies
16Python automationIncident management automated without dedicated automation servers
Canara Bank Single Window Operator, Grade A Aug 2015 to Jun 2016
17IT operations and supportSystems, servers and end-user equipment kept running

What I work with

Security architecture
Security roadmaps, enterprise architecture, SOC amalgamation, Zero Trust (ZTNA), RBI and CERT-In compliance
SIEM and detection
RSA NetWitness, Microsoft Sentinel, Elastic SIEM; EPS optimisation, log normalisation, MITRE ATT&CK
SOAR and automation
Cortex XSOAR (Demisto), Tines, Splunk SOAR; Python, N8N, REST APIs, Backbox
Cloud and endpoint
Microsoft Azure, AWS, hybrid cloud; CrowdStrike Falcon, Microsoft Defender ATP
Network security
Zscaler ZIA and ZPA, Cisco IronPort, Prisma SASE, Palo Alto, Check Point, FortiGate, Cisco, pfSense
Offence and intelligence
Caldera, Metasploit, Wireshark, Security Onion, Wazuh; Anomali ThreatStream, VirusTotal, Unit 42

Certified and studied

CertificationIssued byCredential ID
Certified Security Automation Engineer (PCSAE)Palo Alto Networks0274924b0bed40c4b3d89dc0fa9faeb0
Tines Advanced CertificationTinesaRRRGj89nA
Certified Ethical Hacker (CEH)EC-CouncilECC7598431026
Security+CompTIA5139CJNNTLFQQT35
Education
Post Graduate Program in AI and Data ScienceMIT xPRO2025 to 2026
Master of Technology (M.Tech.)University School of Information Technology2012 to 2014