Leading a 20+ member cybersecurity team, driving incident response, threat hunting, and security automation with tools like Microsoft Defender, Azure Sentinel, Sentinel One, and RSA Net Witness.
Optimizing security monitoring and threat detection by configuring and managing Azure Sentinel connectors, workbooks, playbooks, and KQL queries for threat detection and incident response.
Integrated Microsoft Defender for Endpoint, Office 365, Identity, Cloud Apps with Azure Sentinel for centralized threat response, with automated remediation.
Designing and implementing SIEM dashboards on Splunk, Azure Sentinel, Netwitness to provide real-time monitoring, incident tracking, reduce manual effort, and improve operational efficiency.
Leveraging external threat intelligence feeds such as MISP, ThreatConnect, and FireEye to enhance threat hunting accuracy and proactive defence strategies.
Developing and fine-tuning SIEM detection logic and refining analytics rules and correlation strategies to minimize false positives, enhance threat detection, and improve response efficiency.
Driving continuous security improvements by reviewing and optimizing analytics rules, playbooks, and workbooks quarterly, boosting SOC performance by 15%.
Automated high-fidelity alert containment using Azure Logic Apps, reducing response time by 30%.
Achievements:**
Optimized SIEM rules & correlation log cutting false positives by 40%, improving SOC efficiency.
Automated threat containment with playbooks, reducing manual triaging effort by 30%.
Led the onboarding process for 20+ customers in the Microsoft security suite, ensuring seamless integration and optimized security configurations.
Collaborated with the SOC team to improve SIEM detection logic, refining correlation rules and use cases, resulting in a 20% reduction in false positives.
Conducted proactive threat hunting and leveraged threat intelligence feeds, identifying and mitigating emerging vulnerabilities and risks.
Prepared and presented SOC metrics, risk assessments, and compliance reports to stakeholders, driving a 20% improvement in risk mitigation strategies.
Achievements:**
Scaled SOC operations by recruiting and training 20+ SOC Engineers.
Led a security awareness program, reducing phishing incidents by 50%.
13+ years of experience securing 100+ enterprises by SOC leadership, SIEM optimization, driving incident response, cloud security, threat hunting, firewall management, and security testing.
Expertise in Microsoft Sentinel, Defender, Azure Security, Identity, and Zero Trust Architecture.
Enhanced detection and response capabilities by deploying and fine-tuning SIEM, XDR, EDR, NIDS, IAM, and Zscaler Proxy, increasing threat detection accuracy by 40%.
Strengthened cloud security across AWS, Google Workspace, and Azure by implementing CASB solutions and leveraging CloudWatch and Azure Monitor for real-time threat visibility.
Streamlined SOC operations by automating security workflows with Azure Logic Apps, reducing manual effort by 20% in AV scans, threat enrichment, and high-fidelity alert triaging.
Implemented a Zero Trust and Risk Management Framework aligned with NIST CSF, ISO 27001, CIS Controls, SOC 2, HIPAA, and MITRE ATT&CK, ensuring compliance and proactive threat defence.
Optimized Threat Intelligence & Threat Hunting strategies, leveraging MISP, Tidal, and anomaly-based detection to uncover advanced threats before exploitation.
Entdecken Sie andere Experten mit ähnlichen Qualifikationen und Erfahrungen.