Ashfaq Ahamed Email & Phone Number

As a highly skilled cybersecurity professional with extensive experience in the industry, I have a proven track record of protecting organizations against a wide range of cyber threats. My expertise includes experience in using various tools and technologies to identify vulnerabilities, assess risk, and implement security measures to safeguard sensitive information. Tools and Technologies worked on : - Endpoint security solutions: Cybereason, McAfee, Symantec, SentinelOne, CrowdStrike- IPS/IDS: McAfee NSM, ExtraHop- SIEM/XDR: McAfeeESM, Microsoft Sentinel, StellarCyber Open XDR, ELK, Splunk, Datadog- VA Scanners: Nessus, Rapid7- Detection Engineering: YARA, SIGMA, KQL, Velociraptor- Cloud security technologies: AWS, Azure, Orca Cloud Detection

• 

  Soc Lead - L3

  Isa

  Jun 2024 - Present - Colombo, Western Province, Sri Lanka

  𝐒𝐎𝐂 𝐎𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧• Lead, mentor, and manage a 24x7 SOC team, fostering continuous development, collaboration, and knowledge sharing.• Oversee end-to-end incident response, ensuring timely detection, investigation, and resolution of security threats.• Enable real-time alerting and optimize SIEM use cases for improved threat detection and reduced false positives.• Drive automation initiatives to streamline SOC operations and enhance efficiency.• Oversee shift… Show more 𝐒𝐎𝐂 𝐎𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧• Lead, mentor, and manage a 24x7 SOC team, fostering continuous development, collaboration, and knowledge sharing.• Oversee end-to-end incident response, ensuring timely detection, investigation, and resolution of security threats.• Enable real-time alerting and optimize SIEM use cases for improved threat detection and reduced false positives.• Drive automation initiatives to streamline SOC operations and enhance efficiency.• Oversee shift management to ensure continuous coverage and seamless operations across all shifts.• Manage security use case development aligned with business objectives.• Develop SOC processes for effective ticket management and reporting.• Collaborate with cross-functional teams to address emerging security risks and ensure alignment with overall business goals.• Implement knowledge transfer and training plans to ensure the team remains up-to-date on the latest security practices and tools.𝐃𝐞𝐭𝐞𝐜𝐭𝐢𝐨𝐧 𝐄𝐧𝐠𝐢𝐧𝐞𝐞𝐫𝐢𝐧𝐠• Drive detection engineering efforts by implementing analytical rules, pattern matching, anomaly detection, threshold-based alerts, and impossible travel detection.• Align detection strategies with the MITRE ATT&CK framework to ensure comprehensive threat coverage across the attack lifecycle.• Reduce false positives and enhance observability by integrating diverse log sources into the detection pipeline.• Automate incident response for detected threats, leveraging SOAR capabilities to enable a next-gen SOC experience with automated action initiatives.• Develop playbooks for automated incident response actions based on SIEM alerts.• Ensure log sources are normalized and parsed correctly to maintain data consistency and detection accuracy.𝐓𝐨𝐨𝐥𝐬 𝐚𝐧𝐝 𝐓𝐞𝐜𝐡𝐧𝐨𝐥𝐨𝐠𝐢𝐞𝐬• Microsoft Defender XDR• DataDog SIEM and Cloud Security Management (CSM)• DarkWeb Monitoring• FortiSOC• Microsoft PowerAutomate Show less