Security Analyst
Tech M
Hyderabad
03.2019 - Current
- Working in Security Operation Centre (24*7), monitoring of SOC events, Detecting and Preventing the Intrusion attempts.
- Real time monitoring of Network Security devices such IPS, Firewall, End point Security, Operating system, and Email security etc. to correlate the logs as per client's requirement and also notifying for log stoppage.
- Recognize successful and attempt of cyber intrusions and compromises through log review and analysis of relevant event detail information.
- Working on Nexpose for vulnerabilities assessment on servers.
- Working on Acunetix for vulnerabilities assessment on Web-Applications.
- Nexpose, Acunetix gives you the confidence you need to understand your ever-changing attack surface, focus on what matters, and create better security outcomes
- Development of Reports and Dashboards in Arc Sight & QRADAR
- Recognizing attacks based on their signatures.
- Performing VA on both Web-applications and servers.
- Understanding phases of ArcSight ESM event life cycle and describe the functional processing which occurs during each phase.
- Using AV and other analysis tools to perform Malware Analysis and complete removal of malware from client’s environment.
- Publishing security advisories related to recent security incidents to the clients.
- AV – Malware deletion Failed: Tracking down infected device and removal of virus through manual scanning.
- Differentiate the false positives from true intrusion attempts and help remediate / prevent.
- Support escalation and work closely with stakeholders as required.
- Document all actions taken during incident investigations.
- Work closely with other teams to support the incident management process.
- Provide tuning and filtering recommendations to engineering teams.
- Support requests for data by the customer and other teams analysing daily, weekly and monthly reports.
- Research, analysis, and response for alerts; including log retrieval and documentation
- Monitoring and carrying out second level analysis incidents.
- Analyse and investigate the alerts in SOC monitoring tool to report any abnormal behaviours, suspicious activities, traffic anomalies etc.
- Conduct analysis of network traffic and host activity across a wide array of technologies and platforms
- Assist in incident response activities such as host triage and retrieval, malware analysis, remote system analysis, end-user interviews, and remediation efforts
- Recognize cyber-attacks based on their signatures. Differentiate the false positives from true intrusion attempts and help remediate/prevent cyber attacks
- Analyse malicious campaigns and evaluate effectiveness of security technologies
- Develop advanced queries and alerts to detect adversary actions
- Lead response and investigation efforts into advanced/targeted attacks
- Identify gaps in IT infrastructure by mimicking an attackers behaviors and responses
- Provide expert analytic investigative support of large scale and complex security incidents
- Direct prior experience with core security technologies (SIEM, firewalls, IDS/IPS, HIPS, proxies, vulnerability scanners, AV, etc.)
