Shaik Md Mohsin

• Real Time Log monitoring on Splunk ES in the Security Operations Centre from different devices. .

• Investigating and creating case for the security threats for further investigation and action.

• Reporting, follow-up and mitigation of all and any such security issues found on the network through intelligent identification and prioritization of external attacks.

• Differentiate true and false positive incidents.

• Real Time Log monitoring on SIEM IBM Qradar from different devices like IDS/IPS, Firewalls, Anti-virus etc.

• Handle and review security incidents created by SOC team based on priority of ticket related to Network, Servers, Applications, and end user.

• Works as incident manager and follow ups with end users and all partners to reduce LTTR of tickets.

• Provide Justification to higher management for KPI’s of security incidents.

• Work on the ArcSight ESM providing operations support at the Security Operations Center for US, Canada and Global.

• Recognizes successful / potential intrusions and compromises through review and analysis of relevant event detail information.

• Launch and track investigations to resolution. Recognizes attacks based on their signatures. Differentiates false positives from true intrusion attempts.

• Use the escalation process for multiple users impacting incidents all the time and keep update the management about the progress of the incident.

• Work on the ArcSight ESM SIEM providing operations support at the Security Operations Center.

• Provisioning MSS (Managed Security Service) for Anti DDOS with Arbor Peak Flow cloud server.

• Enabling countermeasures to detect and block DDOS attacks.

Handle the complete incident management framework cycle right from incident identification, incident containment, performing root cause analysis, suggestion, and implementation of preventive and corrective controls.

• Managing and Supporting Symantec Endpoint Protection (SEP).

• Real time log monitoring on ArcSight in the Security Operations Center from different devices such as Firewalls, IDS, IPS received from client and segregating and correlating the logs of devices.

• Security Incident Response and closure of Incidents within SLA using BMC remedy.

• Performs real-time monitoring, investigation, analysis, reporting and escalations of security events.