Swetha Mudegoudra

• Led incident response activities, including containment, eradication, recovery, and root cause analysis of security incidents.
• Performed incident triage, threat hunting, and in-depth analysis of phishing, malware, ransomware, and suspicious user activities.
• Monitored and investigated security alerts from SIEM, EDR, IDS/IPS, firewall, email security, and cloud security platforms to identify and respond to potential threats.
• Correlated events across multiple security tools and analyzed network, endpoint, and authentication logs to detect indicators of compromise (IOCs).
• Fine-tuned SIEM use cases, correlation rules, and detection mechanisms, resulting in improved alert quality and reduced false positives.
• Developed and maintained security playbooks, SOPs, and incident response runbooks, enhancing SOC operational efficiency and response readiness.
• Handled escalated incidents from L1/L2 analysts and provided technical guidance during complex security investigations.
• Collaborated with cross-functional teams to investigate security incidents and implement remediation measures.
• Led post-incident reviews and lessons-learned sessions to identify improvement opportunities and strengthen future incident response.

Facilitated installation, configuration, migration, troubleshooting, and maintenance of Splunk to ensure system reliability.

Configured Splunk agent deployment and maintenance across Unix and Windows platforms.

Applied knowledge of Splunk architecture and core components, including indexer, forwarder, search head, and deployment server.

Supported Splunk upgrades and ES app upgrades.

Resolved configuration-related issues to maintain optimal Splunk performance and availability.

Used Splunk searching and reporting modules, knowledge objects administration, add-ons, dashboards, clustering, and forwarder management.

Investigated device and server connectivity issues affecting reachability toward Splunk.

Delivered weekend on-call support for patching activities on heavy forwarder servers, ensuring system security and uptime.

• Monitored daily health checks for index server, HF servers, event delay, and skipped searches in Splunk Cloud.
• Completed training for Splunk Fundamentals 1 and 2 and earned a certificate.

Monitored and managed real-time events from firewalls, web proxy, WAF, and IPS devices.

Supported real-time security monitoring, incident handling, investigation, analysis, reporting, and escalation of events from multiple log sources.

Reviewed logs, generated reports, analyzed alerts, escalated events, and supported incident response to ensure timely resolution.

Prepared daily shift reports by analyzing log events from all security devices, improving situational awareness.

Created and refined use cases, reviewed SOPs, and contributed to process improvements.

Developed correlation rules for enhanced analysis of security events., dashboards, and knowledge objects in ArcSight.

Researched the latest information security trends to understand current vulnerabilities and threats.

Gathered offense details and raised tickets to the respective team.

Followed standard operating procedures and instructions to complete work in a controlled, consistent manner.