Assessed security data to triage, prioritize, and respond to incidents efficiently
Monitored triggered events and applied judgment to complex cases not covered by SOPs
Performed remediation steps to address identified threats and vulnerabilities, ensuring swift resolution.
Investigated and managed emails reported as phishing to safeguard against potential threats.
Collaborated with automation teams to fine-tune detection systems, and reduce false positives.
Contributed to refining playbooks and automating detection systems to reduce false positives.
Collaborated effectively with global teams across various departments to enhance security measures.
Utilized OSINT to proactively identify and mitigate emerging threats.
Participated in tabletop exercises to evaluate incident response strategies, improve operational procedures, and foster collaborative problem-solving across global teams.
Cybersecurity Analyst Staff 2
Ernst & Young
Trivandrum, India
10.2020 - 09.2022
Worked in a 24x7 Security Operations Center (SOC) handling clients across hospital/medicine, education, beverages, insurance, investment, infrastructure, and asset management industries.
Conducted continuous monitoring and analysis of threats using IDS ,SIEM & EDR tools, performing triaging, advanced detection, and response analysis of security events to identify intrusions and malicious activities.
Utilized sandboxed environments for live response data collection and threat analysis of files of interest.
Investigated malicious phishing emails, domains, and IPs using Open Source tools and provided recommendations for proper blocking based on analysis.
Implemented threat signatures and fine-tuned the SIEM to improve event filtering, reducing false positives.
Maintained continuous expertise in forensics and incident response tools, as well as a comprehensive understanding of advanced persistent threats and attackers' techniques.
Mentored junior analyst team members and provided training and support
Played a key role in team collaboration calls and presentations, establishing credibility for the entire team.
Developed and maintained strong relationships with key stakeholders, ensuring effective communication and collaboration in case management activities and standard operating procedures.
Education
Master of Science - Cyber Security
Glasgow Caledonian University
Glasgow
11.2023
Bachelor in Technology - Information Technology
Kerala Technical University
Trivandrum, India
Skills
Security Tools: Splunk- Enterprise & Phantom, LogRhythm, Cisco ASA, Palo Alto, Fidelis, Carbon Black response, Fidelis Endpoint, CrowdStrike, Microsoft Azure, Microsoft Sentinel, Cisco Secure Endpoint, Cisco Umbrella, Cisco Secure X, Cisco Threat Response, Service Now , Varonis, CyberArk
Languages: Python, SQL, C, C
Operating Systems: Kali Linux, Ubuntu, Windows
Software: VMWare, MS Office
Area of Expertise
Deep understanding of Incident Response, Intrusion Detection, MITRE Att&ck Framework, OWASP Top10, SANS Top 25.
Deep understanding of Window's Active Directory.
Familiar with security and networking protocol such as TCP/IP, UDP, HTTPS, DNSSEC, DHCP, SSH.
Advanced expertise in access management, user provisioning, and remediation of excessive permissions
Identified and exploited vulnerabilities following Lockheed Martin Cyber Kill Chain.
Decent knowledge of Cryptographic algorithms and the attacks.
Knowledge of SOAR technology to improve repetitive processes.
Working knowledge of industry-related security frameworks and policies (e.g. PCI, ISO27001, NIST & GDPR).
Certification
Certified Ethical Hacker v11, EC-COUNCIL , March 2022