•
Performing real-time monitoring, security incident handling, investigation, analysis, reporting and escalations of security events from multiple log sources
•
Evaluating security risks and their impact to the Microsoft Cloud platform and its online services
•
Collaborating with teams to create and potentially execute incident mitigation and remediation plans
•
Working in 24x7 operational support
•
Creating technical documentation for other analysts and other teams to follow
•
Supporting cross company incidents and crisis
•
Assisting in the improvement of processes and procedure to improve incident response times, analysis of incidents, and overall SOC functions
•
Analyzing potential infrastructure security incidents to determines if incident qualifies as a legitimate security breach
•
Producing security incident reports and briefings to be distributed to the team lead and manager
•
In my role as a L1 Security Analyst, I have also been involved in SIEM administration and log management tasks
•
I have experience in performing internal SIEM admin tasks, such as monitoring log stoppage, whitelisting, and health checks
•
I have gained valuable experience in phishing mail analysis and endpoint security
•
I have been responsible for handling tasks related to phishing emails and addressing alerts triggered by various security tools
•
I have also worked on CrowdStrike, monitoring, analyzing, and responding to new detections of threats, including unsafe/abnormal activities and situations where no action has been taken by CrowdStrike
•
Additionally, I have been involved in endpoint security tasks, ensuring the security of endpoints by analyzing and addressing alerts from different security tools
•
My experience in phishing mail analysis and endpoint security has honed my skills in identifying and mitigating potential risks, protecting the organization's assets, and ensuring overall security
•
Practically involved in Wireshark for monitoring network activity
•
Also worked for Incident handler role : Open tickets for incidents and subsequently track the incident handling life cycle across regional Cyber defense teams