- Responded promptly to alerts triggered by security solutions integrated into SIEM platforms.
- Utilised security platforms to verify incident data, initiating preliminary triage upon findings.
• Developed, tested, and fine-tuned detection rules and use cases based on log sources, threat intelligence, and client requirements.
• Escalated incidents based on triage results and managed workflows for true positives.
Identified anomalous activities and malicious behaviors in log data.
Collaborated with shift leads to ensure comprehensive updates on alert management processes.
Developed SOPs, playbooks, and runbooks by working with team members to improve SOC procedures.
• Performed monthly health checks for security monitoring and response tools, optimizing detection accuracy and thresholds.
• Leveraged expertise in Microsoft 365 Defender, Defender XDR, Defender for Endpoint, Defender for Office 365, and Entra ID Protection to improve threat detection and response.
• Participated in red/blue team exercises to test and improve detection and response capabilities.
• Provided detailed reports and post-analysis findings with actionable recommendations for improvement.
Engaged in discussions to remain current on the latest threat landscapes and security methods.