Devansh Parikh Email & Phone Number

- Monitored, investigated and correlated Security events to enable remediation and providesound recommendations to clients in a SOC. - Perform log analysis for malicious events using various SIEM tools to recognize potential, successful intrusion attempts and compromises. - Assisted in building the MXDR service during the initial stages by assisting in building andmaturing SOPs, testing integration of new tools and mentor L1 analysts and train new L2analysts in essential security protocols. Received Outstanding Performance Award for thistask. - Executed Indicator of Compromise (IOC) sweeps for various Zero Day attacks like Log4j bycreating Google Chronicle rules to continuously monitor and gather relevant information andassisted Threat Hunt team by providing detailed report of my findings. - Conducted periodic reviews to tune high volume alerts by applying and filtering usingvarious parameters via Splunk, Chronicle SIEM and Crowdstrike EDR, resulting insignificantly lower volume of False Positive alerts and measurable reduction in AnalystLevel of Effort. - Developed Python scripts to schedule custom powershell scripts for malware removal onoffline hosts by utilizing Crowdstrike Real Time Response APIs. - Built dashboards in various tools to showcase scope of findings and monitor relevantactivity. - Conducted User Acceptance Testing (UAT) for testing, validation and maintenance of newSplunk rules for ServiceNow integration with various security tools. - Participated in meetings with security vendors to provide feedback for better optimizationof their tools

Worked with the client - Erie Insurance.

Mansfield, Texas

o Monitored and Analyzed threat incidents in SentinelOne EDR and Cylance EDR.o Responded to security incidents, escalating appropriately when needed, worked with other teams to resolve issues, and brought investigations to closure.o Assisted in Threat modelling and Security Security Architecture.o Made Rapid7 InsightVM remediation projects based on the emergency patching guidelines and worked with other teams to bring it to completion within the deadline.o Searched for IOCs of security breaches like FireEye attack, Solarwinds, goldtax and others across all the tools with the help of Rapid7 InsightIDR. Made custom alerts and took actions based on recommendation released after the respective breaches and wrote assessments detailing the breach, it's workings and the actions taken.o Identified a flaw in our EDR's detection engine by carrying out experiment regarding DDE attacks and worked with them to get it resolved.o Worked on Proofpoint quarantine email queue.o Worked on cherwell tickets and assisted end users with phishing attempts, malicious links and spam.o Published monthly reports for various tools.o Conducted technical analysis and assessments of security related incidents.o Worked on Rapid7 InsightIDR SIEM tool to centralize, correlate, and analyze data across the IT network to detect security issues and events.o Worked on project to resolve failed logins from various machines which ended up reducing logs by 20 million/week.o Worked to resolve log collection and active networks issue in Rapid7 InsightIDR and Cisco Umbrella.o Developed correlation searches using regex as a part of a Threat Hunting.o Created dashboards and alerts for monitoring for different tools based on their requirements and types of logs.

Mansfield, Texas

o Handled migration of reporting and dashboards of Cylance from SecurityCenter to Elastic stack.o Studied Cylance and Palo Alto logs to write custom patterns for filtering of logs.o Parsed unstructured Cylance logs by using logtstash filters and stashed them in Elasticsearch to search and view logs.o Parsed and separated Palo Alto logs from Syslog using logstash filters and stashed them in Elasticsearch.o Built Kibana dashboards for Cylance and Palo Alto logs by writing search queries to filter relevant data.o Monitored dashboards to find anomalies and effectively ignore false positives.o Found flaws in security policies in Cylance during my first week and took steps to rectify it.o Created cylance security policies to better protect the systems in the network.o Provided technical support for solving the issued ticketso Assisted in upgradation of Palo Alto firewall.o Attended demos for various PAMs like Beyondtrust, Centrify and Cyberark and after-meetings to discuss pros/cons and suitability for integration.o Tested the demo of Sumologic for possible adaptation as replacement for ELK stack.

Master'S Degree, Computer Science

Bachelor Of Engineering (B.E.), Computer Engineering

Education record