Managing Security Consultant team. Provide consultation on technology, process and procedure, and information for SIEM (ArcSight) solution. Being the focal point of contact for clients and for prospect MSS and SOC clients.a) Responsible for Technical Account Manager roles for each customer.b) Responsible for Incident Handling (Incident Response) that required an escalation to Level 3 escalation from SOC operation.c) Lead the deployment for any new SOC and MSS project - also act as Presales Consultant d) Responsible for leveraging on threat intelligence and threat hunting for customer’s environment.Achievement:-Project Manager and Technical Account Consultant for :-- Build SOC for state agency :- involve in Gap analysis, Risk Management, and SIEM solution.

Manage and lead the Security Engineer Team. Provide ad-hoc and planned support for any problem to SIEM (ArcSight) solution. Being the focal point of contact for any new SOC and MSS project.1. Manage Resident Security Engineer located at the client's premise.2. Responsible for Incident Handling that required an escalation to Level 3 escalation from SOC operation.3. Support, troubleshoot for any problem arise in regards to SIEM component :- ArcSight SmartConnector, ArcSight ESM Manager.4. Lead the deployment for new MSS and SOC project.5. Content developing in ArcSight ESM - Dashboard, rules and notification, queries, filter, asset modelling, and use cases.6. Involve in tender preparation for technical related. (MSS and Security Devices Technology)7. Doing Pre-Sales and Sales Engineer support roles - presentation to prospect client for new MSS project and any SIEM related projects.8. Maintaining network and security devices, providing on-the-phone and on-site support as well as providing solution to client.9. Conduct monthly and quarterly maintenance of ArcSight components and network security systems and devices as well as providing support to operations teams in monitoring third party resources for potential security threats and virus updates. 10. Involve in ISO27001 audit and risk assessment - maintain, update and create additional policies, procedures.

Lead and manage Security Operation Center (SOC) using ArcSight as SIEM.1. Focusing on Security Operation Centre functionality on detecting and investigate threats, as well as defending mechanism in response to an attack.2. Supervise in SOC 24×7 shift operation.3. Incident handling as per ITIL requirement.4. Provide event and threat analysis of system and network logs.5. Provide incident management services to customers.6. Ensure incident identification, reporting, escalation management, mitigation and monitoring of day to day operation.7. Handling IT audit/ compliance issues related to SOC Operation Procedure and Process.8. ISO 27001 process oriented - assist on DR and BCP. Undertake risk assessments within scope of the ISMS and ISO based on the documented risk methodology9. Develop, maintain and improve related user guide, administration documents, process and deliveries.10. Customer engagement - provide early warning alert and cyber threat alert services. Provide MSS presentation on monthly basis.

1. Focusing on Security Operation Centre functionality on detecting and investigate threats, as well as defending mechanism in response to an attack.2. Perform reviews/audits of mixed Linux and Microsoft Windows environments, including network devices, databases, web services, and enterprise applications.3.Monitor and analyze the output from various security perimeter monitoring devices and recommend security actions per procedures.4. Coordinate with SOC Engineer team to maintain or troubleshoot defense perimeter and monitoring integrity.5. Provide incident management services to customers & early warning and alert services.6. Provide event and threat analysis of system and network logs.7. Preparing documentation and reporting for customer.8. Provide Quarterly Snort rules update and preventive maintenance on managed servers. Implementing Snort.9. Provide Quarterly Vulnerability Assessment testing for Client's SmartConnector Servers.10. Performing Vulnerability Assessment for various clients under PSS project.11. Involves in X-Maya 6 Cyber Drill conducted by CyberSecurity Malaysia (CSM) in terms of Incident Management Handling.12. Research on latest threats and create the use case.Skills & Knowledge:-ArcSight logger & ESM Installation, troubleshooting, and monitoring.ArcSight Smart Connector Installation & troubleshooting.ArcSight R&D - Implementing rules, reports, dashboard, query viewer, active channels, notifications, active lists & use cases.Logs forwarding from Checkpoint OPSEC to ArcSight SmartConnector.Hardening the OS for SmartConnector agent appliance with a standard guideline which follows the Operating System Hardening Guideline.

- Respond to security alerts.- Acknowledge each security alert that is displayed on the console.- Notify Senior Security Analyst (SSA) or Team Leader in the event of serious security threats.-Send early email notification to agency that is already being verified by SSA in the event of serious security threats.- Filter alerts that is verified as False Positive.- Gather evidences of incidents for Incident Reporting.-Update Signature Information in the system.- Generate log of all the identified security events.- Log daily activities to be reviewed by SSA for reporting purposes.