At Bosch, I monitor and investigate security alerts using Splunk and endpoint telemetry. I review Microsoft Defender for Endpoint alerts, correlate logs, and document incident timelines, scope, and findings.
I investigate phishing and malware, validate indicators with VirusTotal and ANY.RUN, and analyze suspicious authentication and brute-force activity. I also investigate DLP alerts and assess whether data-related activity was blocked or allowed.
I support incident response by preserving evidence and escalating confirmed or suspicious incidents with actionable findings. My work also includes vulnerability assessment with QualysGuard, authorized web application testing with OWASP ZAP, and mapping suspicious activity to MITRE ATT&CK.

