Supervise and drive day-to-day managed SOC services delivery and maturitySupport new client services onboardingDevelop and maintain effective relationships with clients, internal team members, stakeholders, and partners Meet regularly with clients, supporting the Client Success team, to address client needs and offer solutionsProvide internal and client-facing status updates, metrics, and recommended improvementsEnsure services satisfy contract and compliance requirementsParticipate in the recruitment, selection, orientation, training, and continual development of SOC team membersOther duties as assigned

Direct the functions, processes, and operations of the SOC and ensures policies and procedures are followed.Manage the collection, documentation and research of security incidents received via the SOC.Providing CISO/Senior Management with a realistic overview of risks and threats in the enterprise environment.Creation of reports, dashboards, metrics for SOC operations and presentation to Management.Manage the process improvement program for SOC processes.Provide direction, leadership, and management of SOC personnel.Establish performance goals and priorities.Organise larger work streams into projects, effectively allocating team and external resources (customer, other business units, vendors, etc.)Develop and track metrics for team workload and performance, reporting relevant metrics to customers and internal leadership as required.Regularly interface with commercial clients, organizing and implementing project tasks.Provide project management oversight to multiple cybersecurity service initiatives.Track and report financial progress to senior leadership, providing insights for resourcing decisions, project health, information sharing, budgeting, and overall strategic planning.Duties as assigned by CISO.

Direct the functions, processes, and operations of the SOC and ensures policies and procedures are followed.Lead the 24×7 operations of the SOC to ensure optimal identification / resolution of security incidents and enhance client security.Managing the SOC team and shift scheduling.Ensure SLA compliances, process adherence, process improvement to meet operational objectives.Manage the collection, documentation and research of security incidents received via the SOC.Providing CISO/Senior Management with a realistic overview of risks and threats in the enterprise environment.Develop and maintain an incident response management program that includes incident detection, analysis, containment, eradication, recovery, and chain of evidence / forensic artefacts required for additional investigations.Creation of reports, dashboards, metrics for SOC operations and presentation to Management.Manage the process improvement program for SOC processes.Conduct scheduled and ad hoc training exercises to ensure staff are current with the latest threats and incident response techniques.Provide direction, leadership, and management of SOC personnel.Establish performance goals and priorities.Administer performance reviews for SOC personnel.

Round the operations I worked on Security Monitoring.Working on Proofpoint alerts for blocking phishing and spam emails at user level and domain level.Handling Users issues related to URL's being blocked in proxies.Monitoring ePO events on a machine and take necessary actions.Live monitoring of events through SPLUNK.NAC whitelisting of devices after verification.Scheduling and performing Vulnerability Scans on client networks to identify the vulnerabilities exist if any and coordinate till closure.Security Incident Response and closure of Incidents within SLA using Service Now, IBM Resilient & Service Desk.Handling the complete incident management framework cycle right from incident identification, incident containment, performing root cause analysis, suggestion and implementation of preventive and corrective controls and perform security analysis as needed on a case-to-case basis.Prepare weekly & monthly IR report and present the same to client.Drafting SLA Statistics on weekly basis on Incident, Problem and Change Management status updates and improvement plans and forwarding it to respective Project lead, Business Managers, Clients.Review, monitor and manage analyst’s performance.Monitor and maintain competency matrix for the managed team.Advanced investigations.Threat hunting via Splunk and its components.Prepare monthly IR report and present the same to client.Working with other teams to remediate any security flaws.

Round the operations I work on both SOC & NOC.Working on Proofpoint alerts for blocking phishing and spam emails at user level and domain level.Handling Users issues related to URL's being blocked in proxies.Monitoring ePO events on a machine and take necessary actions.Live monitoring of events through SPLUNK.NAC whitelisting of devices after verification.Scheduling and performing Vulnerability Scans on client networks to identify the vulnerabilities exist if any and coordinate till closure.Support day to day Analysis the offence, alerts and traffic, Export logs and generate reports within QRadar (SIEM) environment.Troubleshooting, Log Analysis and deep analysis of Security alerts.Analysis of Sender-recipient relationship, Domain reputation, Email headers, Email content, phishing and malware threat attack and URL E-mails. Monitoring and Managing the Network devices using the Solar winds monitoring tool.Worked on troubleshooting server level alerts and analyze them.Patching the Servers according to the release of Microsoft updates monthly in production and Non-Production environments.Corresponding with Cisco Support on RMA (Return Material Authorization) for resolving hardware (modules, cards, chassis) related issues of Cisco routers, switches installed at client premises.Develop and maintain positive communications between IT Infrastructure and IT Applications / IT Operations.Drafting SLA Statistics on weekly basis on Incident, Problem and Change Management status updates and improvement plans and forwarding it to respective Project lead, Business Managers, Clients.Handing ERT bridge calls effectively and coordinating multiple Infra teams as per BU requirement to identify, isolate and resolve production impacting critical issues.Handle Escalations, SLA maintenance and Process adherence for customers for efficiency in the operational process of the organization

Network security Operations is responsible to pro-actively monitor & support ADP’S WAN Network connections globally. This group operates 24 x 7 all through the year.