Amit Kumar Email & Phone Number

Mumbai, Mh, In

Mumbai, Maharashtra, India

• Lead and manage the Risk and Compliance and Security Operations Center (SOC) team, providing direction, guidance, and support to ensure the team's effectiveness and productivity.• Conducting thorough assessments and evaluations of emerging security products and services to enhance the organization's cyber defense capabilities.• Drive continuous improvement initiatives for GRC processes, policies, and procedures.• Develop an action plan containing policies, practices and procedures… Show more • Lead and manage the Risk and Compliance and Security Operations Center (SOC) team, providing direction, guidance, and support to ensure the team's effectiveness and productivity.• Conducting thorough assessments and evaluations of emerging security products and services to enhance the organization's cyber defense capabilities.• Drive continuous improvement initiatives for GRC processes, policies, and procedures.• Develop an action plan containing policies, practices and procedures that mitigate the identified risks.• Drive the continuous improvement of SOC processes and procedures to enhance efficiency and effectiveness.• Performing review of daily report, Weekly Report, Monthly Report, Threat Summary Report, Governance Report, and ad hoc report.• Asset and use case management via CKC and MITRE techniques for better visibility in terms of threat.• Communicates with management and the internal stakeholders, keeps them informed of potential findings and escalate problems/delays accordingly.• Manage the third-party external audit, risk assessment, and finalize the report with respective stakeholders and share with leadership.• Work on red team assessment and vulnerability remediation with respective stakeholders.• Provide guidance and oversight on security architecture design, implementation, and optimization.• Managing Internal, External, regulatory audit and provide walk through to auditors from SOC perspective. • Analyze the company's information security architecture, including hardware and software components, with the objective of standardizing security throughout company’s infrastructure. • Evaluates and assists in the development of security policies and procedures. • Performing POC for new tools and technologies by getting involved with the vendors.• Management of the ISO Audit and sustenance Audit. Show less

• Lead and manage SOC Team of 15 members.• Responsible to implement Incident Management Process organization wide and ensuring to follow the same.• Log Source Management, Grouping, perform troubleshoot for device not sending logs to SIEM.• Performing next level in-depth analysis for critical incidents and provide recommendations for closure.• Asset and use case management via CKC and MITRE techniques for better visibility in terms of threat.• Participates and ensuring the… Show more • Lead and manage SOC Team of 15 members.• Responsible to implement Incident Management Process organization wide and ensuring to follow the same.• Log Source Management, Grouping, perform troubleshoot for device not sending logs to SIEM.• Performing next level in-depth analysis for critical incidents and provide recommendations for closure.• Asset and use case management via CKC and MITRE techniques for better visibility in terms of threat.• Participates and ensuring the handling of security incidents, recoveries, breaches, intrusions, and system abuses. • Coordinating and conducting event collection, log management, event management and identity monitoring activity using the QRadar.• Research, analyze and understand log sources utilized for purpose of security monitoring, particularly security and networking devices (such as firewalls, routers, anti-virus, proxies, and operating systems etc.).• In depth analysis of logs/events for RCA and evidence of an incident.• Integrating new data source with SIEM using wincollect agent, syslog, database, SNMP etc.• Creating daily report, Weekly Report, Monthly Report, Threat Summary Report, Governance Report, and ad hoc report.• Perform cyber threat intelligence operations including intelligence collection (IOCs), tracking threat actors, identifying, and tracking malicious infrastructure.• Review and analysis of Daily, Weekly & Monthly reports. Investigate anomalies reported, eliminate false positives, and provide a detailed view to the client with the impact & recommendation.• Maintain system health by Identifying vulnerable systems are secured and patched in a timely manner to mitigate all associated threats, in compliance with the Security Policy. Show less

Mumbai, Maharashtra, India

• Lead and manage SOC Team of 10 members.• QRadar Wincollect agent, syslog installation & troubleshooting.• QRadar EPS management (Event management), Log Source Management, use case management, Report and Dashboard management.• Integrating new data source with SIEM using wincollect agent, syslog, database, SNMP etc.• Coordinating and conducting event collection, log management, event management and identity monitoring activity using the QRadar, ArcSight… Show more • Lead and manage SOC Team of 10 members.• QRadar Wincollect agent, syslog installation & troubleshooting.• QRadar EPS management (Event management), Log Source Management, use case management, Report and Dashboard management.• Integrating new data source with SIEM using wincollect agent, syslog, database, SNMP etc.• Coordinating and conducting event collection, log management, event management and identity monitoring activity using the QRadar, ArcSight ESM/LogRhythm.• Research, analyze and understand log sources utilized for purpose of security monitoring, particularly security and networking devices (such as firewalls, routers, anti-virus, proxies, and operating systems etc.).• Provide real-time guidance to clients on network configuration, security settings and policies, and attack mitigation procedures.• Creates, develops and fine tuning the correlation rules.• Creating of technically detailed report on the status of the SIEM to include metrics on items such as number of logging sources, log collection rate, and server performance.• Develop processes and implement tools and techniques to perform ongoing security assessments of the environment.• Keep current with vulnerabilities, attacks, and countermeasures as well as devoting time to research and development activities.• Conducting malware analysis on suspicious code and producing a detailed report of the findings.• Identify and use tools and techniques to conduct static and dynamic analysis of malware.• Conduct advanced computer and network tests relating to various forms of malware analysis, computer intrusion, theft of information, denial of service, multi-national organized criminal groups, and Advanced Persistent Threats (APT)• Perform cyber threat intelligence operations including intelligence collection (IOCs), tracking threat actors, identifying, and tracking malicious infrastructure.• Creation of Daily, Weekly and Monthly SOC report and share with client. Show less

Doha, Qatar

• • Manage shift roster for L1 team and ensure 24*7 availability of L1 team member for SOC monitoring. • Creation of daily SOC report and sharing with client.• Monitoring and analysis of ArcSight SIEM alert.• Incident identification, assessment, quantification, reporting, communication, mitigation, and monitoring.• Fine tuning of ArcSight SIEM rule.• Marinating ArcSight SIEM integrated device asset inventory. • Escalating issues to appropriate stake holders for different… Show more • • Manage shift roster for L1 team and ensure 24*7 availability of L1 team member for SOC monitoring. • Creation of daily SOC report and sharing with client.• Monitoring and analysis of ArcSight SIEM alert.• Incident identification, assessment, quantification, reporting, communication, mitigation, and monitoring.• Fine tuning of ArcSight SIEM rule.• Marinating ArcSight SIEM integrated device asset inventory. • Escalating issues to appropriate stake holders for different application issues wherever needed• Reviewing and ensuring review of authenticated and unauthenticated vulnerability assessment.• VA report generation and analysis. • Work independently and manage workload with organization to meet expectations and objectives.• Day to day DDoS operations to protect 50+ Customer’s (Govt. Organization, Banks, MNC’s).• Monitoring and Maintenance of Arbor Devices (including TMS, PI, CP and APS) for Ooredoo Qatar.• Setting up the Arbor Blacklist / Whitelists against DDoS attacks as per customer’s policy set of services, protocols and IP subnets and setting up countermeasures as per the behavior of attack.• Configuring and managing 25+ Arbor Pravail APS for administrative tasks like protection groups, cloud signaling, backup and fine-tuning counter measure.• Configuring of Managed object for Customers and creating notification groups to trigger emails at the time of attacks.• Configuring and managing the user access, user policy access and device access via PIM (CAPAM). • Regularly monitoring planning for storage of data as per requirement.• Defining access lists, NAT/PAT solutions, policy-maps, service-policies, captures on the firewalls as per the client requirements.• Preparing and Implementing firewall rules scripts for weekly and emergency firewall requests for disabling and enabling ACLs.• Configuring and managing high availability between firewalls, e.g. Cisco ASA.• Provisioning access to new user and troubleshooting existing users using CAPAM Show less

Master Of Computer Applications - Mca, Computer Science, A

Graduated, Information Technology; 2008