At Con Edison, I own the incident lifecycle for phishing and social engineering attacks, from identifying malicious indicators and coordinating containment to escalating complex cases to digital forensics. I also investigate malware, endpoint, and email security incidents using Microsoft security platforms, Splunk, and Phantom SOAR.
During Con Edison's early CSOC buildout, I established investigation procedures, documentation, and onboarding materials as the team expanded to a full multi-shift SOC. I developed a Splunk investigation dashboard that reduced analyst workload by more than four hours per day.
I conduct threat hunts with Microsoft Sentinel, Microsoft Defender Advanced Hunting, and KQL, and investigate DLP incidents involving PII/PHI through Microsoft Purview. I also host daily cross-industry threat intelligence calls with peer utility organizations and contribute intelligence to E-ISAC.
I initiated an AI-assisted CSOC investigation tool with management support. My self-initiated Smart Phishing Email Analyzer project scores and routes suspicious emails, and its presentation to Con Edison management led directly to the current tool initiative.
