• Identify and prioritize security threats detected by the ARC SIEM platform, recommending appropriate remediation actions based on log analysis.• Continuously improve threat detection capabilities by adjusting SIEM rules and use cases based on evolving threats and organizational needs.• Develop and deliver security awareness training for new analysts to improve threat detection skills.• Track and manage customer requests through the IT service management tool, ensuring prompt responses within service level agreements (SLAs).• Collect, analyze, and troubleshoot security-related logs to ensure comprehensive monitoring and minimize falsepositive alerts.• Maintain active communication with internal teams regarding log publication and service tickets.• Provide clear and concise shift reports to ensure smooth knowledge transfer and maintain situational awareness across teams.

• Working on SIEM tool IBM Qradar to monitor network traffic and check any suspicious activities inside the network, also monitoring inbound traffic to check if external Ips are trying to attack.• Working on Cortex XDR to detect advanced threat attacks, investigate auto generated incidents and threat intelligence activities.• Perform incident monitoring, response, triage, and initiate investigations. • Identify suspicious/malicious activities or codes Create and track incidents and request using ticketing tool: (ServiceNow) Investigate malicious domains, files and IPs using Open-Source tools and recommend proper blocking based on analysis.• Identify Akamai Logs to determine successful /failure traffic using filters status code action applied, hostname, connecting IP address in Akamai Console.• Analyzing Malicious Files using file retrieval in Cortex DR and Wildfire Report• Identify True Positive, False Positive alarms based on the customer suggestions and resolveit on priority.• Creating Weekly and monthly status reports and trend reports for various devices and tools.

• Hands on experience of Endpoint Detection and Response tool SentinelOne and SIEM tool Qradar.• Project involves 24*7*365 live security monitoring of 6 hundred thousand plus endpoints, belonging to multiple partners from multiple locations, SentinelOne incident alerting and reporting using Freshdesk console.• Hands on experience in dealing with cases related to live attacks involving Ransomware, Emotet, Mimi Katz, Lateral Movements.• Technical knowledge on how to analyze traffic retrieved from different security devices like FIREWALL, IDS/IPS, PROXIES, VULNERABILITY ASSESSMENT TOOL, ANTIVIRUS.• Good understanding of Severs (DHCP, DNS, SMTP, Proxy, DMZ), protocols, ports, attacks & mitigation.• Working knowledge on analyzing of E-mail Phishing by using MX Toolbox and checking the IP address with threat intelligence (IP void, IBM Xforce, virus total)