•Perform incident response in an MSSP environment for over 70 federal and commercial clients.•Investigate potential IOCs using Microsoft (MSFT) Sentinel and Defender XDR, Kusto Query Language (KQL), Palo Alto Cortex XSOAR, general OSINT, etc.•Resolve investigations within our SLA according to MTTA, MTTI, and MTTR metrics.•Conduct regular client meetings covering the above metrics and client inquiries.•Serve as the technical point-of-contact and subject matter expert for clients.•Lead junior analysts. Guide analysts toward best incident resolution practices by auditing and providing constructive feedback.

• Conducted continuous real-time security event endpoint monitoring leveraging a SIEM from sources including firewall logs, system logs, IDS, applications, databases, data files, and cloud infrastructure. • Analyzed and identify potential threats and security anomalies following OWASP top 10 guidelines, gauging their urgency and network and infrastructure impact, while promptly responding to intrusion alerts and enforcing strong response protocols to meet key KPIs like Mean Time to Investigate (MTTI) and Mean Time to Respond (MTTR).• Investigated malicious activities, pinpoint initial infection vectors, and build timelines of suspicious actions, to identify lateral movement and data loss incidents according to NIST 800-53.• Acted as a key communication link, presenting findings, escalating urgent issues, and bolstering the organization's cyber defense through the Enterprise Security Operations Center.• Collaborated with other teams by writing IP, URL, and Hash block requests.