CHICAGO, IL / SYSTEMS + SECURITY

Rakeshdatta Adapa. Systems Security Developer & Analyst.

I work close to the metal: kernel calls, network protocols, the log data that shows exactly when something broke. I've extended an OS kernel with custom system calls, built a distributed P2P file-sharing network from raw TCP sockets, and shipped an MCP server that lets Claude and other AI agents query live threat intelligence directly. I currently run 24/7 security monitoring across endpoint, identity, and cloud telemetry using Splunk and CrowdStrike Falcon. I want to know how a system works before I decide how to secure it.

View Projects Get In Touch
LinkedIn GitHub
CAREER TRAJECTORY
~5yrs operational tenure
TCS → Infosys → AbbVie, plus contract malware-analysis fellowship
CREDENTIALS
4certifications held
AZ-500 · SC-200 · CompTIA Security+ · Google Cybersecurity
SHIPPED WORK
6independent projects
Real repos: threat intel, distributed systems, data pipelines, agentic AI tooling
~5 YEARS · SECURITY OPERATIONS & INCIDENT RESPONSE CURRENTLY: ABBVIE / SPLUNK + CROWDSTRIKE FALCON AZ-500 · SC-200 · COMPTIA SECURITY+ CERTIFIED MTTR REDUCED 25% (ABBVIE) 6 SHIPPED PROJECTS · PYTHON / JAVA / C / DOCKER 200+ MB/S THROUGHPUT — P2P FILE SHARING SYSTEM M.S. COMPUTER SCIENCE — ILLINOIS TECH (CYBERSECURITY & AI/ML) CHICAGO, IL ~5 YEARS · SECURITY OPERATIONS & INCIDENT RESPONSE CURRENTLY: ABBVIE / SPLUNK + CROWDSTRIKE FALCON AZ-500 · SC-200 · COMPTIA SECURITY+ CERTIFIED MTTR REDUCED 25% (ABBVIE) 6 SHIPPED PROJECTS · PYTHON / JAVA / C / DOCKER 200+ MB/S THROUGHPUT — P2P FILE SHARING SYSTEM M.S. COMPUTER SCIENCE — ILLINOIS TECH (CYBERSECURITY & AI/ML) CHICAGO, IL
01 / OPERATIONAL TENURE
~5 yrs
Years in security operations and systems engineering, from TCS to Infosys to AbbVie: Tier-1 SOC triage through detection engineering and EDR architecture.
02 / CERTIFICATIONS
4
Security+, AZ-500, SC-200, Google Cybersecurity Professional Certificate.
03 / SHIPPED PROJECTS
6
Independent, real-repo projects: threat intel, distributed systems, data pipelines, agentic AI tooling.
04 / SYSTEMS COURSEWORK
5
Graduate systems projects: kernel, shell, blockchain, big data, ML.
05 / MTTR REDUCTION — ABBVIE
25%
High-severity mean-time-to-respond reduction, driven by CrowdStrike RTR containment workflows and process-tree analysis.
06 / VULN REDUCTION — INFOSYS
30%
Critical vulnerabilities reduced via Qualys/Nessus scanning programs.
07 / P2P THROUGHPUT
200+ MB/s
Sustained transfer throughput, P2P file-sharing system (100+ concurrent connections).
02 / EXPERIENCE

Read the system. Then defend it.

~5 years across MSSP, enterprise, and contract SOC environments (TCS, Infosys, and currently AbbVie), plus a malware-analysis fellowship and a Master's concentration built around the systems work underneath it all.

Information Security / Cybersecurity Analyst (Contract) · AbbVie

Nov 2025 – Present
Chicago, IL
  • 24/7 security monitoring and incident investigation using Splunk across endpoint, identity, firewall, and cloud telemetry
  • Architect and tune CrowdStrike Falcon EDR: sensor grouping, IOA rules, and prevention policies
  • Develop MITRE ATT&CK-mapped correlation rules targeting lateral movement, persistence, and privilege escalation
  • Lead forensic incident response: process tree analysis, root cause analysis, and containment via CrowdStrike Real Time Response (RTR), reducing high-severity MTTR by 25%
  • Build executive dashboards and support SOX-aligned audit and compliance reporting

Sr. Systems Engineer / Information Security Associate · Infosys Limited

May 2022 – Nov 2022
  • Conducted vulnerability assessments using Qualys Guard and Nessus, reducing critical vulnerabilities by 30%
  • Monitored security events using Azure Sentinel and CrowdStrike Falcon; led onboarding of Oracle Cloud log sources
  • Presented threat findings to leadership, correlating data from IBM X-Force Exchange and VirusTotal to inform risk-mitigation decisions
  • Integrated AWS and Azure defenses aligned with the NIST Cybersecurity Framework; supported Zero Trust initiatives
  • Tuned detection workflows and response playbooks; mentored junior analysts

Systems Engineer / SOC Analyst (MSSP) · TCS (Tata Consultancy Services)

Jun 2019 – Apr 2022
  • Addressed 20+ high-severity incidents (ransomware, DDoS) across multiple enterprise clients using QRadar, Splunk, ArcSight, and Wireshark for triage and response
  • Streamlined EPS (events-per-second) count extraction for 18 clients using Power Automate, enabling pivot visualizations and saving 60+ hours monthly
  • Automated daily cybersecurity reports for a pharmaceutical client using QRadar for log aggregation and correlation
  • Reduced false positives by 15% by building new detection playbooks and optimizing existing SOC procedures
  • Reviewed and updated firewall rules; ran Qualys/Nessus vulnerability scans; maintained ServiceNow ticketing and SLA compliance
  • Boosted team efficiency by 20% with custom ticket filters and views in a new ticketing system

Cybersecurity Fellow, Malware Analysis · The Build Fellowship

Jun 2024 – Aug 2024
  • Conducted static and dynamic malware analysis using Ghidra, IDA Pro, Remux, Process Monitor, and Regshot
  • Extracted Indicators of Compromise (IPs, MD5 hashes, network activity) and mapped findings to MITRE ATT&CK for detection engineering
  • Recovered encrypted files and assessed cryptographic weaknesses using John the Ripper and Hashcat
  • Authored technical threat reports enriched with CheckPhish, IPVOID, and Cisco Talos, covering malware behavior and remediation

M.S. Computer Science · Illinois Institute of Technology

Jan 2023 – Dec 2024
Chicago, IL · GPA 3.5/4.0

Concentration in Cybersecurity & AI/ML. Key coursework: System and Network Security, Machine Learning, Big Data Analytics, Advanced Operating Systems. These are the same courses that produced the systems projects in the Projects section below.

ILLUSTRATIVE_SOC_WORKFLOW — DETECTION CATEGORIES
Illustrative example
Lateral Movement
T1021.002
SMB / PsExec-style movement correlated across host and network telemetry
Credential Access
T1003.001
LSASS memory access flagged via EDR sensor, tuned against legitimate backup tooling
Identity Anomaly
T1078.004
Impossible-travel sign-ins enriched with GeoIP and user baselines
Persistence / Priv Esc
T1547 / T1068
New service binaries and privilege-escalation attempts in non-standard paths
Illustrative high-fidelity events
14:32:08HIGH Anomalous PowerShell encoded payload — host: WIN-EXAMPLE-01SPLUNK
14:18:52MED Impossible travel: sample account — two regions, <25min apartSENTINEL
13:54:31HIGH Credential dumping via LSASS handle, flagged by EDR sensorCROWDSTRIKE
13:22:09LOW Bulk file permission change on a monitored file shareQRADAR
lateral_movement_illustrative.kql
// Illustrative detection logic pattern — not live telemetry let adminHosts = _GetWatchlist('privileged_assets'); SecurityEvent | where EventID == 4688 and ProcessName has 'psexec' | where Computer !in (adminHosts) | join kind=inner ( DeviceNetworkEvents | where RemotePort == 445 | summarize smbConn = count() by DeviceName) on $left.Computer == $right.DeviceName | where smbConn > 5 | order by smbConn desc
[EXAMPLE] Illustrative query — pattern only, run against a sample workspace, not production data. -------------------------------------------------- Computer: WIN-EXAMPLE-01 TargetDevice: SRV-EXAMPLE-02 smbConn: 14 Notes: demonstrates the correlation shape used for lateral-movement detections built at TCS/Infosys/AbbVie.
T1021.002 DETECTION CATEGORY

Lateral Movement via SMB / PsExec

Correlating process-execution telemetry with network connection data to surface PsExec-style movement between hosts outside expected administrative patterns. It's the same correlation shape used in MITRE ATT&CK-mapped rules built at AbbVie.

Splunk / QRadar Illustrative
T1003.001 DETECTION CATEGORY

LSASS Credential Access

EDR-tuned detection for anomalous process handle requests against lsass.exe, suppressing legitimate backup and AV operations through allow-listing: a category of CrowdStrike Falcon IOA rule tuning done in production.

CrowdStrike Falcon Illustrative
T1078.004 DETECTION CATEGORY

Identity-Based Impossible Travel

Sign-in logs enriched with GeoIP and historical user baselines, tuned to recognize legitimate VPN concentration points while surfacing geo-temporally impossible authentication sequences.

Azure Sentinel Illustrative
03 / PROJECTS

Six shipped repos. Five more you can only read about.

The featured repos are real, independent projects with public code: threat intel, distributed systems, data pipelines, agentic AI tooling. The coursework below has no repo: it's graduate OS, distributed-systems, and big-data work from Illinois Tech, and most of the systems knowledge below traces back to it.

ip-intelligence

PythonOCSFREST APIMCP ServerAgentic AIDocker

Self-hosted IP/domain threat intelligence platform. Aggregates 10 open-source feeds (AbuseIPDB, Emerging Threats, Feodo Tracker, and others), normalizes them into OCSF Class 4001 (Network Activity) events, and exposes both a REST API for SIEM enrichment and an MCP server so Claude and other AI agents can query threat intel directly.

  • 10 live threat feeds ingested, deduplicated, and normalized to OCSF Class 4001
  • REST API for IP/domain lookup, queryable by any SIEM or dashboard
  • MCP server exposing lookup_ip / get_feed_status so AI agents can query threat intel mid-conversation
  • Self-healing feed manager detects stale or broken feeds and re-ingests automatically
  • Containerized for self-hosted VPS deployment
github.com/ard1102/ip-intelligence Live dashboard

P2P Distributed File Sharing System

PythonCustom TCPMultithreadingDocker

A hybrid peer-to-peer file-sharing network: a centralized indexing server for fast search, combined with direct peer-to-peer transfer for bandwidth efficiency. Wire protocol built from raw sockets, with a thread-safe file index, automatic replication, and chunked streaming so multi-GB files don't blow out memory.

  • 100+ concurrent connections at 200+ MB/s throughput
  • Automatic replication targeting 99.9% data availability
  • Resolved concurrent index-update race conditions with proper lock discipline
  • Full Docker Compose deployment with health checks and a live perf-monitoring CLI
  • ~3,500 LOC across 35 files, with a dedicated scaling-test evaluation framework
github.com/ard1102/p2p

PixelPilot Admin

PythonFlaskSQLiteDocker

Full-stack admin dashboard and public image gallery, scoped for small e-commerce sellers who needed a better workflow than forwarding product photos one-by-one. Public gallery includes one-click WhatsApp contact; admin side handles triage, price editing, and a pending → approved → trash status workflow.

  • Table/card view toggle and quick actions cut manual triage effort
  • WhatsApp URL generation with proper encoding for direct contact
  • SQLite schema with unique-filename constraints; RESTful admin API with proper HTTP status codes
  • Multi-stage Docker build with env-var management and health checks
  • ~800 LOC across 15 files
github.com/ard1102/pixelpilot-admin

Kafka Sensor Pipeline Simulation

KafkaClickHouseGrafanaDocker

A streaming data pipeline simulating sensor telemetry: JSON events produced to Kafka, ingested into ClickHouse for fast analytical queries, visualized live in Grafana, with Loki/Promtail wired in for log-based observability across the stack.

  • One-command Docker Compose brings up the full stack
  • Handles high-throughput event streams into a columnar store
  • Live Grafana dashboards for operational visibility
  • Centralized logs via Loki/Promtail for pipeline troubleshooting
github.com/ard1102/kafka_simulation

KeyVaultApp

C#.NET 8WPF

A secrets-management utility focused on secure secret storage and access workflows, centralizing where application secrets live instead of scattering them across config files.

  • Centralized secret access reduces configuration drift across environments
  • Role-based retrieval pattern for safer secret access
  • Companion CLI utility for developer ergonomics
github.com/ard1102/KeyVaultApp

Image Approver

PythonTkinter

Desktop approve/reject workflow tool for triaging large image sets quickly, built to make repetitive batch review (the kind PixelPilot's admin side also deals with) fast enough to not be a bottleneck.

  • Keyboard shortcuts and batch operations accelerate review
  • Theme toggle and undo reduce fatigue and mistakes during long sessions
  • Zoom/pan controls for precise accept/reject decisions
github.com/ard1102/image-approver
Splunk
CrowdStrike Falcon
Azure Sentinel
QRadar
Python
Docker
Kafka
Java
C
PowerShell
kafka_simulation — docker compose up
# Simulated CLI output — demonstrates the project's real Docker Compose stack $ docker compose up [+] Running 6/6 ✔ Container kafka_simulation-zookeeper-1 Started ✔ Container kafka_simulation-kafka-1 Started ✔ Container kafka_simulation-clickhouse-1 Started ✔ Container kafka_simulation-grafana-1 Started ✔ Container kafka_simulation-loki-1 Started ✔ Container kafka_simulation-promtail-1 Started
[producer] sending sensor events to topic 'sensor-telemetry'... [clickhouse] table sensor_events ready, ingesting from Kafka consumer group [grafana] dashboard 'Sensor Pipeline Overview' available on :3000 [promtail] shipping container logs to Loki for pipeline troubleshooting (illustrative CLI output — demonstrates real project structure)
03.1 / SYSTEMS ENGINEERING COURSEWORK

No repo, but this is where it started.

IIT M.S. Computer Science projects: OS internals, distributed consensus, and low-level process/kernel work. The forensic IR and malware analysis on the job draws directly on this.

CS 450 · OPERATING SYSTEMS
xv6 RISC-V Filesystem OS
5 custom syscalls
~3,500 LOC · C / RISC-V asm
Extended the xv6-riscv teaching kernel with syscalls for directory traversal, inode inspection, deletion, and filesystem repair. Also tracked down and fixed a concurrent-access kernel panic with proper kernel-space locking (the annoying kind of bug that only shows up under load).
CRISC-VQEMUGDB
CS 450 · MINI SHELL
Unix Shell from Scratch
execvp-based PATH exec
pipe() / dup2() / fork()
Built piping, sequential (;) and background (&) execution, plus custom builtins (whatif, nonohup). Same fork/exec lifecycle I read in CrowdStrike process trees every week.
CPOSIXUbuntu
CS 550 · ADVANCED OS
Java Blockchain — Pluggable Consensus
4 distributed services · RMI
~1,500 LOC across 15 files
BlockChain, Pool, Validator, and Metronome services with PoW / PoM / PoS consensus swappable via YAML (Strategy Pattern), thread-safe via ConcurrentHashMap.
JavaRMIMaven
CS-554 · BIG DATA ANALYTICS
Google Flu Trends
10M+ records processed
85% correlation accuracy
MapReduce pipeline correlating search behavior with flu outbreak patterns; 60% processing-time reduction via distributed optimization. Companion assignment stood up a multi-node AWS EMR cluster (IAM, VPC, SSH key management).
HadoopAWS EMRPandas
GRADUATE PROJECT
Email Spam Detection
35,000+ emails trained
Naive Bayes · TF-IDF (3,000 features)
NLP pipeline (tokenization → stemming → TF-IDF) comparing Multinomial/Gaussian/Bernoulli Naive Bayes, deployed as a Streamlit app. The classifier's math is the same math behind a phishing filter.
Pythonscikit-learnStreamlit
04 / SKILLS

Seven domains. No tool-name word count.

~5 years across security operations, incident response, and the systems/data engineering underneath it.

Threat Detection & Response

  • SIEM management — Splunk, QRadar, Azure Sentinel, ArcSight
  • CrowdStrike Falcon EDR — sensor tuning, IOA rules, prevention policies, RTR containment
  • Working familiarity — Cortex XDR, Microsoft Defender, Proofpoint (cross-role exposure, not primary tooling like CrowdStrike Falcon)
  • MITRE ATT&CK-mapped correlation rule development, sequenced against the Cyber Kill Chain
  • Forensic incident response — process tree & root cause analysis
IBM X-ForceVirusTotalCheckPhishIPVOIDCisco TalosCortex XDRMicrosoft DefenderProofpointCyber Kill Chain

Malware Analysis

  • Static & dynamic analysis — Ghidra, IDA Pro, Remux, Process Monitor, Regshot
  • IOC extraction (IPs, hashes, network indicators) and ATT&CK mapping
  • Cryptographic / file-recovery analysis
John the RipperHashcat

Vulnerability & Risk Management

  • Vulnerability scanning — Qualys Guard, Nessus
  • Firewall policy review and playbook optimization
  • NIST Cybersecurity Framework, Cyber Kill Chain, Zero Trust, SOX-aligned audit/compliance reporting
QualysNessusNIST CSFCyber Kill Chain

Cloud Security

  • Azure — Sentinel, AZ-500-certified security configuration, Entra / Conditional Access concepts
  • AWS — GuardDuty-style monitoring, IAM, VPC, EMR cluster security
  • Cross-platform defense integration (AWS + Azure)
Azure SentinelAWS IAMVPC

Scripting & Automation

  • Python (advanced) — FastAPI, Asyncio, Streamlit, Pandas
  • PowerShell, Bash — Power Automate workflows saving 60+ hrs/month across 18 clients
  • Agentic AI tooling — built the MCP server for ip-intelligence, so Claude and other AI agents can call its REST/data APIs directly
  • Private MCP server for VPS administration — Docker container/service control, remote exec, disk and system diagnostics, log tailing over SSH
  • SQL
PythonPowerShellBashSQLMCPSSH

Systems & Distributed Systems Programming

  • C / POSIX — process control, pipes, kernel syscall extension (xv6), shell development
  • Java — RMI-based distributed services, ConcurrentHashMap, ExecutorService
  • Python distributed systems — custom TCP protocols, multithreading, chunked streaming
  • Docker / containerized deployment
CJava RMIDocker

Data & Big Data Engineering

  • Hadoop / MapReduce, AWS EMR, HDFS, S3
  • Kafka, ClickHouse, Grafana, Loki/Promtail
  • Applied ML — Naive Bayes classification, NLP pipelines (NLTK, TF-IDF)
KafkaClickHouseAWS EMR
05 / CERTIFICATIONS

Four certs. Check the links yourself.

Foundational security, Azure security engineering, Microsoft security operations.

Foundation Level

CompTIA Security+

Issuer: CompTIA
  • Validates baseline skills for core security functions and IT security roles
  • Emphasizes risk management, threats, attacks, and vulnerabilities
  • Covers security architecture, cloud and virtualization concepts
  • Includes cryptography/PKI, identity and access management, and secure operations
Verify
Associate Level

AZ-500: Azure Security Technologies

Issuer: Microsoft
  • Implements and manages security for Azure, multi-cloud, and hybrid environments
  • Secures identity and access with Microsoft Entra and Conditional Access
  • Secures networking, compute, storage, and databases across Azure services
  • Configures Microsoft Defender for Cloud and Microsoft Sentinel for threat protection
Verify
Associate Level

SC-200: Security Operations Analyst

Issuer: Microsoft
  • Reduces organizational risk by triaging and responding to incidents
  • Hunts threats using intelligence and KQL across Microsoft Sentinel
  • Mitigates exposure using Microsoft Defender XDR and Defender for Cloud
  • Advises on improvements to threat protection and policy compliance
Verify
Foundation Level

Google Cybersecurity Professional Certificate

Issuer: Google
  • Introduces security domains, frameworks, and controls, including the CIA triad and NIST
  • Covers SIEM tools, network protocol analyzers, and packet analysis
  • Builds skills in Linux, Bash, SQL, and Python for security tasks
  • Focuses on risk, threats, vulnerabilities, and incident response fundamentals
Verify
06 / CONTACT

Systems, security, or both — reach out.

Open to conversations about security engineering, detection/SIEM work, or systems-heavy roles. Reach out directly. Email and LinkedIn are both good.

Emailrd.choosy000@passinbox.com LinkedInrakeshdatta-a-ba787ba2 GitHubgithub.com/ard1102
LocationChicago, IL

YOUR_SESSION
IP —
CONNECTION —
PROTOCOL —
BROWSER / OS —