13. Enterprise Security Remediation & Mailbox Protection
Overview
Engineered an automated post-delivery threat remediation and end-user security incident reporting platform protecting enterprise mailboxes against zero-day phishing attacks and weaponized emails at Cisco Systems. Built an automated search-and-destroy service that triggered immediate retroactive message clawbacks across distributed Microsoft 365 and Exchange environments whenever newly identified Indicators of Compromise (IOCs) were published by threat intelligence feeds. Developed a cross-platform Outlook add-in using TypeScript, Office.js, and Microsoft Graph APIs enabling enterprise employees to flag suspicious emails directly to security analysts with one click. Designed backend quarantine queues and administrative review workflows backed by PostgreSQL and Celery with strict role authorization and tamper-evident audit logging. Compressed incident response times for weaponized emails from hours of manual SOC hunting to seconds of automated remediation.
Challenge
When newly weaponized attacks or zero-day phishing campaigns bypassed initial perimeter defenses prior to threat feed updates, enterprise security operations lacked automated mechanisms to instantly hunt, quarantine, and retract delivered malicious messages across thousands of employee mailboxes.
Approach
- Engineered an automated post-delivery remediation service triggering retroactive search-and-destroy actions when new Indicators of Compromise (IOCs) are published.
- Developed a cross-platform Outlook add-in utilizing Office.js and Microsoft Graph API enabling end users to report suspicious emails directly to the SOC with one click.
- Constructed administrative quarantine and audit queues with role-based approval flows for high-risk message restoration or permanent purging.
- Built closed-loop feedback pipelines feeding user-reported phishing payloads directly into scanning and threat intelligence engines to accelerate signature deployment.
Outcome
Compressed the remediation lifecycle for newly identified malicious email campaigns from hours of manual SOC hunting down to seconds of automated purge actions, significantly containing lateral attack spread across enterprise mailboxes.