Ranga Nagarjuna Tulimelli

Roles & Responsibilities:

• Monitored and triaged security alerts across SentinelOne EDR, Graylog SIEM, and Palo Alto Firewalls
• Performed initial investigation of endpoint alerts using SentinelOne Storyline™
• Analyzed behavioral indicators to identify malware, ransomware, and suspicious activity
• Executed response actions including process termination, file quarantine, network isolation, and rollback as per SOP
• Blocked malicious SHA256 file hashes in SentinelOne to prevent re-execution across endpoints
• Validated IOCs such as hashes, IP addresses, domains, URLs, and file paths
• Used Deep Visibility™ for basic endpoint search and alert verification
• Monitored and analyzed logs in Graylog SIEM from endpoints, servers, and network devices
• Investigated alerts generated by Graylog streams and event rules
• Performed log correlation to identify suspicious patterns and attack attempts
• Analyzed Windows Event Logs and Linux syslogs for abnormal behavior
• Detected failed logins, brute-force attempts, and unauthorized access attempts
• Monitored Palo Alto firewall traffic, threat, and URL filtering logs
• Investigated blocked and allowed connections based on firewall security policies
• Identified port scans, DDoS indicators, and suspicious outbound connections
• Correlated firewall events with SIEM and EDR alerts during investigations
• Performed basic root cause analysis (RCA) by analyzing process trees, user activity, and logs
• Identified infection sources such as phishing emails, malicious downloads, or USB devices
• Documented investigations, actions taken, and RCA findings in the ticketing system
• Escalated confirmed incidents to L2 SOC with complete analysis and evidence

Roles & Responsibilities:

• Provided SOC operations support using Microsoft Azure Sentinel (console & web console) and other SIEM tools for multiple global clients.
• Monitored dashboards and alerts, identifying critical security events and taking prompt action during shifts.
• Managed the complete incident lifecycle, including identification, containment, root cause analysis, and remediation.
• Conducted real-time monitoring, investigation, and analysis of logs from multiple security and industrial appliances.
• Participated in weekly and monthly client review meetings, providing updates on security posture and incidents.
• Created custom SIEM reports, dashboards, filters, and active channels to meet client requirements.
• Scheduled and performed vulnerability scans, tracked findings, and coordinated remediation until closure.
• Handled Security Incident Response using ServiceNow, ensuring SLA compliance and proper documentation.
• Analyzed phishing, spam, and other security threats, notifying users and providing mitigation guidance.
• Investigated incidents to determine true positives vs false positives, providing actionable recommendations.
• Assisted clients directly during high-priority incidents, helping mitigate attacks and minimize impact.
• Troubleshot SIEM dashboard and reporting issues, ensuring data availability and accuracy.
• Maintained knowledge of OWASP Top 10, IDS/IPS, threat modeling, and attacks like DOS, DDOS, MITM, SQL Injection, XSS, and CSRF.
• Supported multiple global customers by analyzing networks for potential security threats and recommending improvements.
• Prepared daily and weekly dashboards on security threats, network activity, and incident trends for management reporting.