• Monitoring real-time security event on SIEM solutions Splunk and Netwitness (RSA).• Analyze network flow data for anomalies and detect malicious network activity.• Observe security solutions; firewall appliances, intrusion prevention systems, data loss prevention systems, analysis tools, log aggregation tools• Experience analyzing phishing emails, evaluating dangerous URLs and attachments, measuring user impact using Splunk, remving/deleting phish emails from exchange systems, and blocking undesired senders.• Take follow-ups and closing of the tickets based on the client response.• Generating and Making Daily, Weekly and Monthly report.• Monitoring inbound and outbound traffic for firewall and investigation event.• Creating and fine-tuning the rules to eliminate the false positives. • made recomendations to improve security procedures and systems.• Investigate VPN alerts and reach out to users to confirm legitimacy of such activity.• Monitor the health of security devices and Syslog instances and respond to anomalies as defined in the SOP. • Utilizing threat intelligence tools to support the daily cyber security operations, and produce intel analysis of threat actors, IOCS, and vulnerabilities.