Piro andtheBeat

I’m a Cyber Security Analyst with 3+ years’ experience in SOC operations, specialising in threat detection, incident response, and infrastructure security. I work with Microsoft Sentinel, Entra ID (Azure AD), and Defender XDR to monitor networks and systems, investigate phishing and identity attacks, and support structured incident workflows.

In my current SOC Analyst role, I monitor and triage alerts across Microsoft Sentinel, Defender XDR, Defender for Cloud, and Defender for Cloud Apps. I investigate identity and cloud-based threats using Entra ID sign-in logs and audit logs, and I use KQL to query, pivot across entities, and strengthen detection coverage. I also refine runbooks and Sentinel playbooks, contributing automation via Logic Apps for recurring incident scenarios.

Previously, as a Cyber Security Analyst, I triaged email, cloud, and endpoint security alerts within SLAs and performed log-based investigations to confirm scope and root cause. I executed containment and remediation actions like endpoint isolation, credential resets, and threat removal, while communicating clearly with clients using non-technical language. I also identified recurring alert patterns and detection gaps, improving SIEM alert tuning and reducing noise.

Earlier, I worked as an IT Security Administrator for 150+ users, supporting reliable service delivery and owning identity operations including user provisioning, access control, and Group Policy. I led an Active Directory migration with zero service disruption, administered Windows Server hardening and patching, and used Nessus/Qualys with CVE/NVD analysis to track remediation to closure. Alongside my work, I build SOC and Microsoft Sentinel labs and KQL hunting packs on GitHub, supported by certifications including Security+, SC-200, and ISO/IEC 27001 Lead Implementer.