Khayam Khan

I’m a results-driven cybersecurity professional with 5+ years of combined experience across Security Operations, Incident Response, Vulnerability Management, and Cloud Security. I’ve worked in both MSSP and enterprise SOC environments, where I focused on fast triage, clear investigation, and measurable risk reduction.

In my current role as a Cyber Security Analyst at Sourcepass, I monitor and triage alerts using ConnectWise SIEM (formerly Perch) and perform log analysis with Lucene/KQL for threat correlation and investigation. I initiate incident response for malware infections, scareware, data leakage, and account misuse—driving containment, eradication, and recovery.

I also strengthen endpoint and cloud visibility by leveraging SentinelOne EDR for threat detection, investigation, and hunting, along with Microsoft Sentinel and Microsoft Defender for Cloud for Azure-connected monitoring. I tune detection logic using KQL and validate client adherence to security standards through Microsoft Purview and related compliance/loss-prevention reviews.

Earlier, I supported DICT-NSOC Security Operations Center operations across 30+ government agencies, analyzing incidents using firewall, IDS/IPS, and endpoint telemetry, and contributing to baseline and policy improvements. Prior to SOC work, I served as a Junior Systems Engineer (Middleware), performing Linux administration (RHEL), automation with Bash/Shell scripting, and incident response support for middleware platforms—experiences that sharpen my operational discipline and troubleshooting mindset.