SOC Analyst with proficient and thorough experience and a good understanding of Information Security. Specialized in proactive network monitoring through SIEM (QRadar, Azure Sentinel & Vectra) and assist with the development of processes and procedures in order to improve incident response times, analysis of incidents, and overall Security Operations Center functions, ensuring confidentiality, integrity and availability of the systems, networks, and data.
Roles &Responsibilities:
1.Having 5.2 years of experience in Information Security and working in 24x7 SOC environment as senior SOC Analyst to ensure the integrity and protecting networks, systems, and applications from serious threats and intrusions.
2.Having good knowledge and experience on IBM QRadar, Azure Sentinel, VECTRA SIEM (Security Information and Event Management) in monitoring, analyzing and escalating real-time incidents.
3.Having good knowledge and real time experience on analyzing and remediating Phishing attacks, Malware incidents using Microsoft Defender EDR and Any.run sandboxing tool.
4.Experience in understanding the logs of various network devices (Firewall, Anti-virus, Windows Server etc.). Expertise in defining resources like Quick Filters, Dash Boards, Data Monitors etc.
5.Knowledge and experience in integrating log sources and performing basic troubleshooting in IBM QRadar SIEM. Knowledge on use case creation and finetuning. Creating Daily, Weekly and Monthly dashboards/reports to the customer as per their requirement.
6.Preparing SOC runbooks and SOPs and sharing them with the customer and offshore team.
7.Proactively monitor and block the IOCs of latest Malware/Ransomware/Phishing from OSINT. Advising customers about evolving threats, vulnerabilities and the potential impact to environment by publishing security advisories and suggesting possible mitigation controls.
8.Create tickets for the necessary tasks that need to be executed by external teams. Ensure tasks are communicated via email to the respective teams and track down the open tickets, resolve them without breaching the SLA and annotating them from the bucket as per ticketing SOP.
Information Auditing
Log Analysis
Incident Response
SIEM management
Identifying, Monitoring, and Analyzing Risk and Incident Response and Recovery