Naveed Khan Senior Security Engineer
Santa Clara, CA • naveed.khan@gmail.com • +1 408-555-0136
Profile Summary
- Senior Security Engineer with 7 years of experience securing cloud-native enterprise security environments across cybersecurity vendor, observability SaaS, and financial-services, specializing in AppSec scanning at scale, AWS + GCP cloud-security posture, and detection engineering.
- Solid technical background across AppSec scanning (Snyk, Burp Suite Enterprise), cloud security (Prisma Cloud, AWS), identity & access (Okta), vulnerability management (Tenable), detection & SIEM (Splunk, CrowdStrike Falcon), DevSecOps tooling (Checkov, OPA), and languages (Python, Go) with strong fundamentals in threat modeling (STRIDE, PASTA), MITRE ATT&CK-aligned detections, and risk-based prioritization.
- Deep expertise in security-by-design review, risk-based vulnerability prioritization, detection-as-code engineering, and DevSecOps automation, leveraging methodologies such as threat modeling and design review and MITRE ATT&CK-aligned detection design to drive secure, observable, and developer-friendly engineering.
- Engaged collaborator working cross-functionally with Engineering, SRE, IT, and Legal/Privacy teams in security-as-partner environments, contributing to design-review boards, audit prep, and incident retrospectives with a developer-first, ownership-first mindset.
- Emerging leader who shares technical excellence and fosters a culture of signal-over-noise discipline and paved-road security defaults through RFC reviews and security office hours, while leading security guild and threat-model sessions and authoring widely adopted detection and IaC-policy templates.
Technical Skills
- Application Security & AppSec Scanning:
- Snyk, Semgrep, Checkmarx, Veracode, Sonatype, Burp Suite Enterprise, OWASP ZAP, secure code review, SDLC partnering
- Cloud & CSPM:
- AWS (IAM, GuardDuty, Security Hub, KMS), GCP (IAM, Security Command Center), Azure, Prisma Cloud, Wiz, Orca, workload protection
- Identity & Access:
- Okta, Entra ID, AWS IAM Identity Center, CyberArk, SSO, MFA, RBAC/ABAC, JIT access, privileged access management
- Vulnerability Management:
- Tenable, Qualys, Rapid7, CVSS + EPSS scoring, asset criticality, remediation SLAs, risk-posture reporting
- Detection & SIEM:
- Splunk (SPL, Enterprise Security), Microsoft Sentinel, Google Chronicle, MITRE ATT&CK, SOAR workflows, custom rule authoring
- Network & Endpoint Security:
- Palo Alto NGFW, AWS WAF, IDS/IPS, network segmentation, Zero Trust (BeyondCorp-style), CrowdStrike Falcon, SentinelOne, DNS & email security
- DevSecOps & Automation:
- Checkov, tfsec, Trivy, container image scanning, secrets scanning (gitleaks, truffleHog), OPA / Kyverno, GitHub Actions security pipelines
- Languages & Compliance:
- Python, Go, Bash, SOC 2, ISO 27001, PCI DSS, HIPAA, NIST CSF familiarity, security training & phishing-sim programs
Education
Work Experience
- Owned security engineering across the cloud platform organization for the Cortex and Prisma cloud-platform engineering org supporting 1,400+ engineers, leading end-to-end coverage across threat modeling and design review, AppSec scanning and triage, and cloud-security posture across 320+ production services.
- Ran the AppSec scanning program with Snyk and Burp Suite Enterprise, driving SAST integration in every CI pipeline, open-source dependency (SCA) governance, and paired developer-remediation reviews, triaging 4,800+ AppSec findings with 91% of critical findings closed within SLA.
- Owned the cloud-security posture program on Prisma Cloud across 180+ AWS and GCP accounts, enforcing IAM least-privilege baselines, KMS key rotation and SCP guardrails, and cross-account network segmentation, cutting critical misconfigurations by 73%.
- Drove identity and access governance across Okta and AWS, applying just-in-time access via Okta workflows, RBAC and ABAC roles across AWS + SaaS, and privileged-access reviews and break-glass procedures for 2,800+ human and service identities, cutting standing-access tickets by 68%.
- Ran risk-based vulnerability management on Tenable using CVSS + EPSS prioritization, asset-criticality scoring per service, and weekly remediation-SLA dashboard across 14,000 scanned assets, driving open critical CVEs from 312 down to 48.
- Built the team's MITRE ATT&CK-aligned detection program on Splunk and CrowdStrike Falcon, shipping custom Splunk SPL detections, CrowdStrike Falcon EDR tuning, and SOAR playbooks for alert auto-triage, shipping 140+ custom detections and cutting false-positive rate from 34% to 9%.
- Embedded DevSecOps guardrails in CI/CD via secrets scanning with gitleaks pre-commit, IaC scanning with Checkov on every PR, and OPA Gatekeeper policies on Kubernetes admission, instrumenting 220+ CI/CD pipelines and blocking 98.4% of non-compliant deploys.
- Led incident response and forensics support across 38 Sev 1 / Sev 2 incidents, applying containment and eradication playbooks, memory and endpoint forensic triage, and root-cause postmortems with preventative actions, cutting mean time to contain from 4.1 hours to 48 minutes.
- Designed and operated zero-trust network and endpoint controls including device-trust and posture checks via BeyondCorp pattern, WAF rule tuning and DDoS playbooks, and DNS and email-security guardrails, delivering phishing-click rate down from 11% to 1.8% across 4 quarters.
- Owned the compliance and risk-reporting program via SOC 2 + ISO 27001 evidence collection, quarterly risk-posture briefings to engineering leadership, and PCI scope reduction project, clearing 2 SOC 2 Type II audits passed with zero high-severity findings.
- Worked closely with Engineering, SRE, IT, and Legal/Privacy teams to coordinate security-design reviews on RFCs, phishing simulations and security training, and incident-postmortem reviews, training 640 engineers across 6 quarterly sessions and mentoring 3 junior security engineers through their first on-call rotations.