1) Experience in leading the security operations for multiple clients in monitoring, detection and incident response.2) Creation of SIEM rules/use cases/reports and their regular tuning.3) Rich experience of Phishing email analysis, security logs analysis, trend analysis & RCA analysis of security incidents.4) Performed threat hunting, investigations & resolved escalations.5) Applied threat intelligence and TTPs to identify affected systems & extent of attack aiming to provide effective remediation steps.6) Understanding of Cyber Kill Chain, MITRE ATT&CK, methods of exploitation and signatures associated with advanced threats.7) Contributed in integration of security devices logs to SIEM.8) Defined run books for response to security alerts & cyber threats.9) Effectively led client meetings working as a single point of contact for different type of clients at a time & prepared weekly/monthly dashboards.Technical Skills:Hands on experience on leading tools like:● SIEM: Azure Sentinel, ArcSight , Securonix, Google Chronicle● EDR: CrowdStrike● NGFW: Palo Alto, Checkpoint, Fortinet● Proxy: Zscaler Cloud Portal● Network Analysis: Wireshark● SOAR: Micro Focus, Chronicle● Ticketing: ServiceNow, RSA Archer, Manage Engine, Symphony Summit ITSM● Analytics: Power BI● Microsoft Office: Excel, Word, PowerPoint, OneDrive, SharePoint

• Determination and direction of remediation & recovery efforts.• Review of latest alerts to determine relevance & urgency on top tools.• Provide analysis and trending of security log data from many heterogeneous security devices.• Detection and investigation of threats and respond to them in a timely manner.• Leverage emerging threat intelligence (IOCs, updated rules) to identify affected systems and the scope of the attack.• Creation of use cases and perform in-depth log analysis.• Preparation of weekly/monthly reports to provide detailed insights.• ArcSight | Securonix | Microsoft Sentinel | RSA Archer| ServiceNow