Cyber Incident Responder

Analyzed and responded to security incidents escalated from the SOC, ensuring timely containment, remediation, and prevention of further impact. Executed containment strategies, including isolating compromised systems, blocking malicious IPs/domains, and disabling accounts, to mitigate threats and prevent lateral movement within the network. Managed and resolved 15+ security incidents per week, including phishing, malware infections, and unauthorized access attempts, achieving a 95% on-time resolution rate Identified, tracked, and acted on Indicators of Compromise (IOCs) to mitigate the impact of attacks. Proactively conducted threat hunting using advanced tools and threat intelligence sources to uncover undetected threats and enhance overall protection. Conducted in-depth investigations using tools such as Microsoft Sentinel, Microsoft Defender XDR, Carbon Black, Tanium, Abnormal AI, Forescout, Canary/Bluejay, Varonis, and others, leveraging KQL queries for advanced threat hunting and root cause analysis to mitigate threats effectively.

Security Operations Center Analyst

Actively monitored and triaged alerts from Microsoft Sentinel, Defender 365, and other SIEM tools, escalating confirmed threats to the Incident Response (IR) team for investigation and resolution, while prioritizing and assessing security incidents based on severity, impact, and risk to ensure efficient resource allocation. Reviewed and analyzed logs from firewalls, endpoints, and SIEM solutions (e.g., Microsoft Sentinel) to uncover attack vectors and anomalous activities, conducting log analysis and correlating threat intelligence to validate true positive alerts while refining detection rules to improve alert accuracy and reduce false positives. Utilized security tools such as Abnormal AI, Forescout, Tanium, Carbon Black, Palo Alto Cortex, Canary/Bluejay, and Varonis to strengthen the organization\'s security posture.

Cyber Security Engineer Intern