● Incident Response activities.● Work with key stakeholders to implement remediation plans in response to incidents.● On-boarding new customers and integrating log sources (Servers, Network Device etc) with SIEM tool.● Experience in troubleshooting of log source (server) integration. ● Collect global threat intelligence and help integrate it with current security tools proactively research and monitor security information to identify potential threats that may impact the organization.● Knowledge and hands-on experience with QRadar and Wazuh SIEM tool.● Creating Reports (Daily, Weekly, and Monthly) as per requirement.● Creating SOP and Documents for Team.● Experience with Security Information Event Management (SIEM) tools. Fine-tune SIEM rules to reduce false-positive and remove false negatives.● Co-ordinate with various teams while log source integration.

• Perform Security SIEM Operational task - Analysis, Filters, Reports Suggestion on fine tuning on existing rules.• Creating Dashboards as per requirement.• Creating Reports (Daily, Weekly, and Monthly) as per requirement.• Creating new use case on integrated Log Sources.• Working on incidents and reviewing the alerts and do detailed analysis on alerts.• hands on experience on the Incident Response activities like malware analysis.• Good knowledge on TCP/IP, Security concepts, WAN and LAN concepts, Firewall policies.• Working on assign ticket queue and understanding and exceeding expectation on all tasked SLA commitments.• Escalating issue to level 2 and management when necessary.• Investigate incidents using Dashboard/Events/reports.• Monitor real-time security events on SIEM (QRadar) console and Event Analysis and Investigating and mitigation.• Good understanding on different types of attacks.• Conduct proactive monitoring, investigation, and mitigation of security incidents• Analyse security event data from the network (QRadar SIEM).• Ensure the integrity and protection of networks, systems, and applications by technical enforcement of organizational security policies, through monitoring of vulnerability scanning devices.• Conduct log analysis using IBM QRadar• Identify suspicious/malicious activities or codes.• Monitoring and analysis of security events to determine intrusion and malicious events.