Responsible for leading the Cyber SOC monitoring team as per the scope and does the incident management. Provide technical direction to analysts on handling the incidents and creating the knowledge base articles. Publishing the reports as per the requirement from the Managers.

Team - Cyber Defense centerTools Handled: Akamai Kona - Web application Firewall, Palantir, Balabit RDP session Monitor, Snort NIDS, Symantec HIDS, Splunk, Imperva Securesphere for Database monitoringResponsibilities : Real time Security Monitoring and Incidence Response team in 24*7*365 environment. Analysing SIEM logs and raising Incidents based on criticality. Configuration of Policies & Notifications in SIEM tools. Triage and analysis on Phishing emails. Analysing the Malware attacks, fine tuning the existing use cases in Splunk. Auditing the Session Bypass Incidents. Monitoring Incidents & Attack Analysis on Web application firewall- Layer 7 protection against DDOS and DOS. Investigating and addressing various requirements from MAS (Monetary Authority of Singapore). Identifying the Attack vectors, WAF Rule Analysis, liaising with Vendor and providing insights for effective DDOS protection and web application protection. Performing WAF monitoring and analysing the WAF Alerts. Monitoring and analysing Database activities and the RDP gateway sessions to Critical bank applications with respect to insider threats. Responsible for managing Balabit devices across 6 countries. Escalating the incidents identified and follow-up with respective team until closure.

SIEM,SOC - Monitoring and analyst

Support engg