NEHA BOBADE

L2 Digital Security – Rapid Response Team (RRT)
Project: Macy's KTLO (Keep The Lights On)

• Monitor and analyze security events, alerts, and attack patterns across Macy's and Bloomingdale's e-commerce applications and critical business infrastructure.
• Utilize Akamai security solutions to detect, investigate, and mitigate web application attacks, bot traffic, DDoS threats, and malicious activities.
• Perform continuous security monitoring through Akamai Console and security dashboards to identify potential threats and security incidents.
• Investigated persistent attack attempts, analysing attack patterns to identify root causes and recommending remediation actions.
• Monitor Akamai WAF alerts and security events to identify suspicious traffic.
• Monitored customer-facing applications 24x7 using Akamai Security Console, detecting and responding to web application attacks.
• Monitored and investigated Application & API Attack (AVA) events, abnormal traffic patterns, and malicious activities impacting Macy's and Bloomingdale's online platforms.
• Analyzed security dashboards on SentinelOne to identify suspicious authentication attempts, anomalous login behavior, and potential account compromise.
• Respond to security incidents in real time by performing threat analysis, impact assessment, and incident resolution.
• Support the protection of high-volume customer-facing online retail platforms by ensuring continuous security monitoring and rapid threat response.
• Analyze security logs, traffic behavior, and threat indicators to detect unauthorized activities and potential compromises.
• Collaborated with security, infrastructure, and application teams to implement mitigation measures, enhancing overall security posture.
• Prepare incident reports, document findings, and provide recommendations to prevent future security incidents.

Tools & Technologies: Akamai WAF, Akamai Security Centre, SentinelOne, Splunk, Security Monitoring, Incident Response, Threat Analysis, Web Application Security, DDoS Mitigation, Threat Hunting, Log Analysis, Cybersecurity Operations.

• Lead and manage daily security operations within a SOC, overseeing the monitoring, detection, and response to security threats across enterprise networks and systems
• Act as a senior member of the SOC team, providing expertise in incident response, threat analysis, and vulnerability management to ensure the organization's security posture remains strong
• Analyzed, triaged, and escalated security alerts, incidents, and events, adhering to established procedures.
• Conducted in-depth security investigations and root cause analyses of incidents using advanced tools and techniques to effectively minimise security risks
• Collaborated with cross-functional teams to identify, prioritise, and mitigate security risks, ensuring alignment with organisational goals and compliance requirements
• Lead the identification, evaluation, and implementation of security technologies to strengthen overall defense mechanisms
• Recommended continuous improvements to security policies, processes, and technologies to enhance incident prevention efforts

• Conduct global threat intelligence (IOC) research and hunting based on reports and indicators of compromise (IOCs)
• Monitored SIEM tools to identify anomalies in network or host-based activities, enhancing security posture within customer environments
• Report and investigate issues identified during live traffic monitoring to ensure prompt resolution
• Raised P1 incidents promptly to ensure immediate attention and resolution. within SLA and promptly inform clients via call, taking necessary actions when required
• Handled first-level incidents, provided initial assessment and resolution according to defined protocols
• Prepared briefings and reports detailing analysis methodology and results, facilitating informed decision-making for internal stakeholders and customers
• Perform offline searches to detect suspected communication or malicious activity
• Monitor server status and analyze log source trend data to ensure timely reporting and system health
• Prepare customer reports and maintain records for auditing purposes, ensuring compliance with standards

• Performed 24/7 SIEM monitoring for MSSP environments, alerting on incidents and alerts as they occurred
• Monitored security events and raised incidents of P2 and P3 severity levels.
• Analyzed traffic flow, monitored events, and managed reports and logs, ensuring effective oversight of network security
• Maintained detailed records of security monitoring activities and incident responses using case management tools and technologies
• Managed incident lifecycle and coordinated with customers to ensure timely incident closure
• Ensured compliance with service level agreements (SLAs) by managing timelines and coordinating incident responses
• Escalated incidents to L2 support in case of any deviation or complexity beyond first-level resolution
• Followed Standard Operating Procedures (SOPs) to conduct first-level troubleshooting and issue resolution
• Registered and resolved customer complaints, enhancing satisfaction through prompt issue resolution
• Generated end-of-shift reports for documentation and knowledge transfer, facilitating seamless continuity for subsequent analysts
• Worked in a 24-hour rotational shift schedule to maintain continuous monitoring and support

• Strong experties in routing protocols, firewall configuration, and netwok security. Delivered solutions to Telecom Exchange engineers, improving issue resolution speed
• Resolved technical issues for copper broadband exchanges, enhancing service reliability
• Coordinated with Internet Service Providers (ISPs) to address exchange-related technical issues, ensuring seamless connectivity
• Virtual provisioning of TAMS and Tie Pairs equipment used by engineers during physical connection setups at exchanges
• Verified and validated engineer details prior to resolving technical issues
• Allocated new equipment to engineers working in the field
• Managed system records by performing changes, updates, and upgrades
• Maintained accuracy by updating records across LLU Autofix, WLR Autofix, and Flow systems