Open to opportunities

ESRA DEMIR

@esrademir

Message

I investigate federal cyber threats and build SOC capabilities that strengthen security response.

United States

Message

What I'm looking for

I'm looking to continue strengthening detection and response capabilities through hands-on SOC investigations, threat hunting, automation, and mentoring. I value opportunities to improve alert fidelity, communicate clearly with stakeholders, and grow in cybersecurity.

At IBM, I triage and investigate roughly 150 security alerts per shift for a federal healthcare client, correlating Azure identity activity, EDR detections, phishing, and network logs to establish scope and recommend containment. I use Splunk Enterprise Security Cloud, Cortex XSOAR, Qualys, Palo Alto platforms, MITRE ATT&CK, and threat intelligence to prioritize response, improve detections, and communicate clear incident findings.

Previously, I helped build the Pittsburgh Penguins' first SOC, strengthened email security with FortiMail Cloud, implemented Okta IAM and RBAC, and conducted threat hunting with FortiEDR. I've also supported 24/7 SOC operations at CyberNow Labs and investigated transaction fraud at PNC Bank.

Experience

Work history, roles, and key accomplishments

Current

Federal Cyber Threat Detection and Response Analyst

Current

IBM

Nov 2024 - Present (1 year 9 months)

Triage and investigate security alerts in a 24/7 SOC supporting a federal healthcare client, working ~150 alerts per shift across Splunk Enterprise Security Cloud, Cortex XSOAR, Qualys and PaloAlto Networks platforms. Investigate identity and authentication alerts in the client's Azure environment to separate account compromise from benign activity.

Splunk Enterprise Security XSOAR Qualys Palo Alto Networks Azure ServiceNow OSINT Threat Intelligence Incident Response SOC Operations

Cyber security Analyst

Pittsburgh Penguins

May 2023 - Sep 2024 (1 year 4 months)

Spearheaded the creation of the company's first Security Operations Center (SOC), deploying security frameworks, technologies, and incident response protocols. Optimized email security and compliance by configuring FortiMail Cloud, applying advanced security policies and rules.

FortiMail FortiEDR Okta IAM RBAC Threat Hunting Incident Response GDPR HIPAA

Fraud Analyst

PNC Bank-TekSystems

Jan 2023 - May 2023 (4 months)

Investigated and evaluated suspicious transactions, identifying and preventing potential fraudulent activity. Tracked real-time transaction alerts across multiple channels, including credit card, ACH, and wire transfers.

Actimize Fraud Detection Transaction Monitoring Risk Assessment Data Analysis

Security Operations Center (SOC) Analyst

CyberNow Labs (CNL) LLC

Mar 2021 - Jan 2023 (1 year 10 months)

Provided 24x7 cybersecurity operations support, including detection, response, and threat hunting. Evaluated firewalls, DNS, and VPN configurations using tools like Fortinet, ProofPoint, Resilient, and Jira.

Fortinet ProofPoint Resilience Jira Nessus Netsparker SentinelOne Splunk Enterprise Security Vulnerability Management SIEM

Pharmacy Operations Manager

Walgreens Pharmacy

Nov 2016 - Aug 2022 (5 years 9 months)

Managed pharmacy operations, overseeing daily activities and ensuring compliance with regulations. Led a team to provide quality customer service and efficient workflow.