Assisting GSOC Team with tickets and Responding to alerts and investigating potentialsecurity incidents.Documented AWS security incidents, including root cause analysis and remediation steps,to facilitate post-incident review and enhance future incident response capabilities.Monitored hybrid cloud environments including on-premise and AWS cloud, ensuringcomprehensive security coverage.Utilized Zscaler, Carbon Black EDR tools,Trend mirco DLP ,Izoologic to enhancecybersecurity measures and threat detection, ensuring robust protection of organizationalassetsAnalyzed and investigated incidents, data breaches, malware attacks, etc. to determine thescope of impact and appropriate response actions.Maintained detailed documentation of incident response activities, including timelines,actions taken, and lessons learned, to facilitate continuous improvement of securityprocesses.Investigate malicious phishing emails, domains, and IPs using OSINT and recommendproper blocking after analysis.Proficient in collecting evidence for audits and adept at managing stakeholders throughoutthe process, ensuring thoroughness and transparency in compliance efforts.

Incident monitoring and Response of alerts on Elastic & ArcSight SIEM Tool. Monitoring Dark Web events using Cyble.Fine-tuning of the Use Cases to reduce false-positive and noise alerts. Recommending actions/solutions based on incidents.Investigating incident and building a picture about the incident.Develop content for SIEM by writing custom rules, correlation rules, dashboards, reports and alerts.Updating IOCs in MISP Threat Intel Tool.Creating Ticket, Incident Explanation to clientActively involved in threat hunting activities from building hypothesis to finding evidence and enhancing security controls and detection logicInvestigating incidents, remediation, tracking and follow-up for incident closure with concerned teamsPerform root case analysis of incidents/breachesMaintaining and improving Playbooks and processes