Abhinav Roy

Schneider Electric · Bangalore

• Accountable for delivery, service design and commercial performance of a nine-contract managed security portfolio (MDR, asset visibility and vulnerability management, controls management) for energy, manufacturing and utilities customers.
• Designed the global delivery model: delivery concentrated in India, small in-region teams where data-sovereignty or regulation requires them.
• Grew the SOC team from 7–8 to 30 with zero attrition over the past year; built the goal framework and promotion paths across all service lines.
• Built the practice's capacity and cost-to-serve model: how many more customers the team can absorb and what each service line costs to run.
• Run the automation and AI roadmap: automated reporting and SOAR playbooks live, KPI dashboards replacing manual decks, an AI-assisted L1 triage business case.
• Lead the OT/IT detection strategy across Claroty, Nozomi and Tenable, aligned to IEC 62443 and MITRE ATT&CK for ICS: more than 230 custom OT detections built in-house on Microsoft Sentinel.
• Led ISO 27001:2022 certification of two operations centres through Phase 1 and Phase 2 audits; 95%+ SLA compliance sustained.
• Senior incident handler and escalation point for major incidents; solution authority on proposals and bids; shaping a new detection-engineering-as-a-service offering.

Schneider Electric

• Led 24×7 MDR operations across a multi-customer portfolio: investigations, vulnerability assessments and incident response across OT/ICS and IT.
• Built ATT&CK for ICS-aligned detection libraries and Snort/YARA rule frameworks; deployed Claroty and Nozomi into previously unmonitored OT networks.
• Incident response lead; wrote the SOC playbooks and escalation procedures the practice still runs on.

Ernst & Young (EY)

• MDR delivery, threat hunting and R&D for 15 enterprise clients; built NSM and EDR detection pipelines on ELK, Velociraptor and MISP; automated IOC enrichment with MISP and Cortex.

HSBC

• Engineered 50+ SIEM use cases against ATT&CK; detected and contained DNS beaconing from a legacy OT production-line machine; cut phishing triage from 45 to under 8 minutes with SOAR.

Genpact India, for Cox Communications

• Identity and access management (PKI, 2FA, access governance), then security operations on ArcSight SIEM.

brief.girder.in · case study

• Designed, built and run in my own time: an AI-assisted pipeline that reads 30 public sources each morning and sends the ten OT/ICS stories that matter at 10:00 IST, each mapped to Purdue level, who should act and what to do if you cannot patch.