Looking for a job

Matthew Shiroodi

@matthewshiroodi

Message

Cyber Incident Responder at Accenture who refined MDE detection rules, reducing false positives by 33%.

Australia

Message

At Accenture, I triage Splunk alerts and investigate client incidents, using forensic imaging, artifact analysis, and endpoint remediation to respond to threats.

I authored and refined MDE detection rules that reduced false positives by 33% while maintaining detection accuracy. I also investigate risky sign-ins, anomalous authentication, and phishing alerts in Microsoft Entra ID, MDI, and Proofpoint.

Previously at Digicor, I analyzed alerts across more than 23 endpoints using the MITRE ATT&CK framework and coordinated incident response, reducing response time by 47%. I also introduced an SIEM tool, improving network security and visibility.

On the Enterprise Tunnelling Tool Detection Project, I tested attacker techniques and developed behavioral detections in Microsoft Defender XDR/EDR. I collaborated with Security Engineers on automating incident creation and stakeholder communications.

Experience

Work history, roles, and key accomplishments

Current

Cyber Incident Responder

Current

Accenture

Feb 2025 - Present (1 year 9 months)

Triaged ~12 Splunk SIEM alerts daily via SPL queries, authored KQL detection rules in MDE reducing false positives by 33%, and managed ~4 client incident tickets daily with end-to-end investigation and remediation. Investigated identity and email threats using Microsoft Entra ID, MDI, and Proofpoint, and automated incident response tasks with security engineers.

Splunk SPL KQL Microsoft Defender Microsoft Entra ID MDI ProofPoint Tanium Trellix Mandiant Redline ServiceNow Archer Security Automation Incident Response Threat Detection Digital Forensics

Senior Security Analyst

Accenture

Sep 2024 - Feb 2025 (5 months)

Monitored and triaged ~25 Splunk SIEM alerts daily, prioritized responses in line with SLA targets, and escalated around 5 cases daily to Tier 2 and Tier 3 analysts with full investigation notes via ServiceNow and Archer.

Splunk SIEM Incident Triage Escalation Management ServiceNow Archer SLA Management

Cyber Security Analyst

Digicor

Jun 2023 - Sep 2024 (1 year 3 months)

Led incident response efforts by analysing alerts from over 23 endpoints using the MITRE ATT&CK framework, achieving a 47% reduction in response time. Introduced an SIEM tool into infrastructure, achieving 70% optimization in lightweight deployment and an 85% increase in network security and visibility.

Incident Response MITRE ATT&CK SIEM Network Security Threat Mitigation

System Engineer

Digicor

Nov 2022 - Jun 2023 (7 months)

Built Supermicro HPC servers with on-call datacenter support, managing BMC/IPMI access and firmware updates. Documented and investigated client issues, escalating them to a team of 2 System Engineers, resulting in a 54% reduction in response time for issue resolution.

Supermicro HPC BMC IPMI Firmware Updates Data Center Support Client Communication Documentation