At Infosys, I investigate Microsoft Sentinel alerts across an enterprise client environment, using KQL to examine suspicious logins, malicious IP communications, device events, and permission changes.
I use Microsoft Defender for Endpoint for protection and response, including sensor deployments, Azure VM onboarding, endpoint isolation, and remote-wipe initiation. I also coordinate identity and access work across Microsoft Entra ID and Active Directory.
I built a Power BI and API-based workflow that posts Defender device-health and onboarding status to Microsoft Teams, replacing repetitive manual checks and saving approximately 40–60 hours annually. I also supported a Varonis-driven SharePoint permission exposure reduction effort covering 300+ sites.
At Infosys, I authored Defender procedures and onboarding documentation, supported a transition to managed-service delivery, and mentored junior engineers. I prepare security reports and presentations, participate in CAB discussions, and coordinate with the external SOC and infrastructure and security teams.
