• Analysing Realtime Security Incidents and checking whether its true positive or false positive.• Performing Realtime Monitoring, Investigation, Analysis, Reporting and Escalations of Security Events from Multiple log sources.• Installing Splunk apps and Addon on the Splunk.• Installation of Universal Forwarder on the servers for logs collection.• Responsible for upgrading the universal Forwarders to the new version.• Doing the troubleshooting in case any device is not reporting to the Splunk.• Creation of dashboard, reports in Splunk.• Working experience in Searching and Reporting in Splunk having good SPL knowledge.• Maintain keen understanding of evolving internet threats to ensure the security of client networks.• Troubleshooting SIEM dashboard issue when there are no reports getting generated and no data available.• Excellent Hands on experience on Crowdstrike EDR module. • Sound knowledge in Handling the detections and Triage. • Good at using performing the searches and building up the reports and dashboards. • Using threat intelligence module for threat hunting. • Good at understanding Sandboxing reports. • Good at performing the EDR host and user management. • Installation/Uninstallation of agents on endpoints. • Great idea on overall EDR functions.• Better understanding on EDR and it's operation. • Excellent in handling the malware and performing the Dynamic analysis.

• Worked in 24x7 Security Operation Centre• Monitoring the customer network using Splunk SIEM.• Act as first level support for all Security Issues.• Analysing Realtime Security Incidents and checking whether its true positive or false positive.• Performing Realtime Monitoring, Investigation, Analysis, Reporting and Escalations of Security Events from Multiple log sources.• Raising true positive incidents to the respective team for further action.• Creating tickets on Service Now and assigning it to the respective team and taking the follow-up.• Escalating the security incidents based on the client’s SLA and providing meaningful information related to security incidents by doing in-depth analysis of event payload, providing recommendations regarding security incident mitigation which in turn makes the customer business safe and secure.• Contacting the customers directly in case of high priority incidents and helping the customer in the process of mitigating attacks.• Work closely with business units to ensure that they know what and how to feed data into the SIEM.• Investigate malicious phishing emails, domain, and IPs, using open-source tools and recommend proper blocking based on analysis.• Good knowledge of Splunk Distributed Cluster Architecture.• Detail knowledge of the working functionality of various components of Splunk such as Indexer, Search Head, Heavy Forwarder, Deployment server etc.• Installing Universal Forwarder to integrate Windows and Linux devices.• Integrated FortiGate Firewall with Splunk.• Installing Splunk apps and Addon on the Splunk.• Monitoring Realtime Incidents in Splunk Enterprise Security.