Dhawal Shah

About Me

Information Security leader with 10+ years of experience in Incident Response, Threat Intelligence, and Security Operations. I combine deep technical expertise with business-aligned security leadership. Currently leading Security Operations, IR, and Threat Intelligence at Dream11, where I implement and lead comprehensive security programs across multiple business units within the Dream Sports portfolio.

Specializing in building scalable processes, playbooks, and automation for efficient SOC operations. Hands-on experience with enterprise security tools, cloud platforms (AWS, GCP), and security orchestration. Proven track record of aligning security strategy with business objectives to enhance organizational cyber resilience.

Professional Experience

Lead Security Engineer

Dream11 - Mumbai

October 2022 - Present

Implement and lead Security Operations and Threat Intelligence programs from scratch spanning multiple Business Units within Dream Sports portfolio
Drive end-to-end threat monitoring, incident response, and security governance
Build scalable processes, playbooks, teams, and automation for efficient SOC operations
Hands-on experience with SIEM and SOAR (Elasticsearch Cloud and N8N)
Build scalable data pipelines for efficient SOC operations with dynamic log sources
Align security strategy with business objectives to enhance cyber resilience
Collaborate with cross-functional teams to strengthen organizational security posture

Senior Solution Architect

Cyware - Mumbai

December 2020 - September 2022

Led team of security architects/engineers in designing on-premise and cloud-based infrastructure solutions, including complex POCs
Collaborated with customers to address post-implementation needs and recommend product features
Managed end-to-end delivery of customer use cases, mapping them to Cyware products
Delivered impactful demos and presentations highlighting value propositions
Supported Sales Engineers in solution selling and strategic deal execution
Served as Cyber Security Technical SME for the Cyware team
Built strong client relationships and tracked industry trends and technologies

Solution Architect & Security Architect

Cyware - Mumbai

December 2018 - November 2020

Worked as Security Architect collaborating with project teams to plan, design, and implement Cyware software
Acted as technical account manager, serving as communication link between market needs and development teams
Developed and documented Solution Architecture Models
Led product integrations, coordinating with customers on requirements and solution integration
Served as Technical SME for incident response, automation, orchestration, and Python-based automation
Designed on-premise and cloud-based infrastructure solutions including complex POCs

Risk Manager (Incident Response & SecOps)

HDFC Bank - Mumbai

June 2016 - November 2018

Incident Response & Threat Hunting: Led incident investigations, performed digital forensics and malware analysis, conducted threat hunting, and automated response tasks
Threat Intelligence Management: Processed and operationalized threat intelligence, researched emerging threats, and managed TI feeds
Security Operations: Developed SOC use cases, improved logging quality, built regex/parsers for log normalization
Security Projects: Contributed to WAF/IPS baselining, ATM security alerting, Deception Technology POC, and wireless rogue AP detection

Technical Skills & Expertise

🛡️ Security Operations

SIEM (Elastic Search Cloud, Qradar, Splunk)
SOAR (N8N, Cyware labs)
Threat Intelligence (Cloudsek, CTIX, STIX, TAXII)
Incident Response & Forensics
Threat Hunting & Analysis

☁️ Cloud & Infrastructure

AWS Services (EC2, ECS, RDS, S3, CloudFront, WAF, Elasticsearch, SQS, SNS)
GCP Services (GCS, Pub/Sub, Compute Engine, Logging Explorer, SCC, Cloud CDN, Load Balancer)
Cloud Security Architecture
Infrastructure as Code

🔐 Security Tools & Products

CSPM (Orca)
WAF (AWS WAF, Cloud Armor)
EDR (Fireeye HX/NX/EX, Elastic Defend, Trend Micro)
AV (Sophos MDR, Symantec AV)
PAM (Arcos, Teleport)

⚙️ Automation & Development

Python Programming
JIRA Automation
Slack Automation
API-based Automation
Security Orchestration