SOC Analyst

Monitored and investigated security events in IBM QRadar, performing alert validation, triage, forensic analysis, and escalation of confirmed incidents. Analyzed IDS/IPS alerts, firewall data, network traffic, and security logs to identify malicious activity and support containment and remediation.

Conducted vulnerability and risk assessments using Nessus and Nmap, documented findings, and coordinated remediation with stakeholders. Investigated phishing emails, suspicious domains, and malicious IP addresses using OSINT and threat intelligence techniques.

Supported security controls including firewalls, VPN, IAM, PAM, PKI, IDS/IPS, SSL/TLS, IPsec, and LDAP. Partnered with incident response, GRC, and development teams on audit remediation, compliance activities, and security-control improvements.

Triaged and investigated security events using Splunk, FireEye, Sourcefire, and Cisco IronPort. Correlated network traffic, IDS/IPS alerts, and firewall logs to identify threats, escalate confirmed incidents, and support remediation activities.

Collected, normalized, and prioritized security telemetry to improve investigation workflows. Integrated indicators of compromise and indicators of attack to strengthen threat detection and response consistency.

Managed McAfee DLP controls to protect sensitive information and support compliance requirements. Conducted vulnerability assessments, supported penetration-testing activities, and developed cybersecurity KPIs and KRIs for governance reporting and security operations oversight.

Monitored SIEM alerts, security logs, endpoint telemetry, and network traffic to detect and investigate suspicious activity across Windows and Linux environments. Performed threat hunting and IOC analysis using EDR telemetry.

Applied MITRE ATT&CK and Cyber Kill Chain concepts to structure investigations. Analyzed TCP/IP, DNS, HTTP, and SMTP activity to identify anomalous behavior and support root-cause analysis.

Implemented Cisco IronPort email-security policies to block malicious messages, IP addresses, and domains. Collaborated with SOC L1/L2/L3 analysts during incident escalation, containment, and mitigation, while creating onboarding and training materials for SOC analysts.