I am working in antivirus domain for a defence customer. I am using Symantec Endpoint Protection tool. My role is to: Patch Updates across devices Installation of SEPM client on the desktops and servers Scan for viruses if the IP is suspended or in USB or hard drives to check whether something malicious has entered or not.

Worked as Cyber Security professional as SIEM Engineer for a large Telecom data center & part of the team which is responsible for security threat management and mitigation. My experience and knowledge areas are as below:  Expertise in ArcSight SIEM ESM & Logger configuration  Threat hunting based on ESM alerts and forensic log analysis  Configuration of ArcSight ESM Use cases based on Industry best practices and threats captured in Logger  Knowledge of MITRE framework and its use in SIEM configuration  Configuration of Operational Reports  Integration and management of pre-configured rules from Microfocus website  Customer interactions in terms of use case demonstration and explanationI have built 30+ ESM usecases & successful demonstration to BSNL Security team with self initiative and learning from industry experts  Used Linux commands to take out source logs of the endpoint devices

I was responsible to deal with the real time Cyber security threats  Role involved analysis the logs and accordingly give solution to the user to how to deal with the threat  In the log analysis, I used to identify if the Destination IP, whether it is malicious or not and whether it is a blacklisted IP  Analyze the source workstation which is basically from which server the threat is generating from and also see the event reason i.e why it has been generated  If the destination IP is malicious I have to inform the user and accordingly block the IP & send these logs to the user also so that they can also see the reason behind generating this threat  The attacks that I have handled are Brute Force Attack, Policy Violation, Suspicious Login, Potential Malware Infected Host