At Infosys, I monitor enterprise security alerts across Microsoft Sentinel, IBM QRadar, and Splunk Enterprise Security, investigating endpoint, network, identity, and email activity to establish incident severity and root cause.
I analyze phishing emails and suspicious files, using static and dynamic malware analysis to identify behavior and indicators of compromise. I also use KQL and SPL for threat hunting and log analysis.
I correlate logs and endpoint telemetry to reconstruct attack timelines, and use the MITRE ATT&CK Framework to classify attacker techniques. My investigations include authentication threats such as brute-force attacks, password spraying, and suspicious privileged-account activity.
I document SOAR playbooks and incident handling processes, manage investigation records in ServiceNow and Jira, and review vulnerability findings from Qualys and Tenable Nessus. I also coordinate incident response activities with Network Security and Infrastructure teams.
