Open to opportunities

Tag Ram

@tagram

Message

I build and operate SIEM detections and investigate security incidents.

Czechia

Message

I've built and operated SIEM monitoring and detection capabilities across ArcSight, Splunk, QRadar, and ELK, with hands-on experience investigating endpoint and email threats.

At CIBCGlobal-AnewzTV, I conduct threat hunting and investigate CrowdStrike Falcon alerts, endpoint telemetry, phishing attempts, malicious files, URLs, hashes, and email attachments. I document findings and support triage, escalation, containment, remediation, and recovery activities.

At Vodafone Prague, I deployed and maintained ArcSight ESM and Splunk, onboarded and normalized security logs, and developed correlation rules, dashboards, searches, and detection use cases mapped to MITRE ATT&CK.

My background also includes CrowdStrike EDR/XDR monitoring at Marelli Magneti Automotive Lighting, FortiMail and FortiSandbox administration at Fortinet, and ArcSight SIEM engineering at ING-NN Bank Group.

Experience

Work history, roles, and key accomplishments

Current

SOC Analyst

Current

CIBCGlobal-AnewzTV channel International

Aug 2024 - Present (2 years 1 month)

Performed threat hunting and endpoint behavior analysis to identify suspicious activity and potential indicators of compromise. Investigated security alerts and incidents in CrowdStrike Falcon, including DLP-related alerts and endpoint detections.

Threat Hunting Endpoint Behavior Analysis MITRE ATT&CK IOC IOA CrowdStrike Falcon Cloud Security Splunk IBM QRadar Phishing Analysis Incident Response AnyRun Virus Total

SIEM & Security Operations

Vodafone

Jan 2022 - Dec 2024 (2 years 11 months)

Deployed, configured, and maintained SIEM platforms including ArcSight ESM and Splunk. Onboarded log sources, performed daily log analysis, and tuned SIEM alerts and correlation rules to improve detection accuracy.

ArcSight Splunk SIEM Engineering Log Management Log Analysis Event Correlation Security Monitoring MITRE ATT&CK Detection Engineering Correlation Rules

Security Engineer

Marelli Magneti Automotive Lighting Ltd

Jan 2018 - Dec 2022 (4 years 11 months)

Monitored and investigated endpoint detections and suspicious activities using CrowdStrike Falcon EDR/XDR. Performed alert triage, incident classification, and initial response actions in accordance with incident response procedures.

CrowdStrike Falcon Cloud Security EDR XDR Telemetry Incident Response Alert Triage IOC Analysis

FortiMail

Fortinet

Jan 2017 - Dec 2018 (1 year 11 months)

Configured and administered FortiMail email security gateway to protect corporate email infrastructure. Managed anti-spam, anti-virus, anti-phishing, and email filtering policies, and investigated phishing and malware-related email incidents.

FortiMail Email Security Anti spam Phishing Defense Email Filtering Phishing Analysis MXToolbox SPF DKIM DMARC FortiSandbox Malware Analysis

SIEM ArcSight Specialist

ING-NN Bank Group

Jan 2013 - Dec 2017 (4 years 11 months)

Installed, configured, and administered ArcSight SIEM for centralized security monitoring and event analysis. Designed and maintained correlation rules, monitored security events, and coordinated incident resolution with infrastructure and application teams.

ArcSight SIEM Log Management Correlation Rules Security Monitoring Incident Response Dashboarding Reporting