•SIEM Monitoring and SOC Operations - analyzes security event data from SIEM tool to get the right balance between caution, false positives and incidents, while providing effective security monitoring and incident response through triage, investigation, communication, reporting and escalation• Analyzed systems on client's network to identify vulnerabilities, anomalous network behavior, compromised network hardware, and advanced malware.• Work with supervisor to resolve issues and follow… Show more •SIEM Monitoring and SOC Operations - analyzes security event data from SIEM tool to get the right balance between caution, false positives and incidents, while providing effective security monitoring and incident response through triage, investigation, communication, reporting and escalation• Analyzed systems on client's network to identify vulnerabilities, anomalous network behavior, compromised network hardware, and advanced malware.• Work with supervisor to resolve issues and follow documented escalation procedures• Analyze security event data from the network (IDS, SIEM).• Conduct proactive monitoring, investigation, and mitigation of security incidents• Conduct log analysis and Security monitoring using Siem• Investigate malicious phishing emails, domains and IPs using Open-Source tools and recommend proper blocking based on analysis.• Review internal logs and alerts to determine and detect potential cybersecurity events. Triage cases based on output from automated alerts, and determine when to escalate to tier 2/3 resources• Document actions in tickets to effectively communicate and track information with team members and internal customers • Document, follow and improve policies, procedures, and best security practices• Monitor events, respond to incidents, and report findings and escalate critical tickets if need.• Prioritize and differentiate between potential intrusion attempts and false alarms.• Use Service Now to create tickets for third party supports in resolving SOC issues.• Responsible for investigating suspicious and potentially malicious activity within the networks and systems.• Performed Header analysis, Blacklist check for IP, Hyperlinks, analyze encoded html files etc.• Work with legal team to take down fake domains that impersonate the real client domain.• Identify suspicious/malicious activities or codes• Worked in a 24x7 Security Operations Center Show less