At Deloitte USI, I handle threat response cases across phishing, endpoint malware, Microsoft Entra ID, and threat intelligence. I use KQL to investigate related email, endpoint, and sign-in activity, and retuned Microsoft Sentinel analytics rules to cut alert volume by about 30%.
I built CTI Monitor to review more than 200 security sources a day, assess reliability, and extract indicators and attacker techniques. I added prompt changes and validation checks to address inaccurate extractions, and the threat-intel team now uses it for its daily source review.
