Aravind S R

Security Engineer

Target corporate services pvt ltd

Oct 2022 - Present

Experience in handling and deploying the Defender agents onto servers to onboard them into Defender, and troubleshooting agent connectivity issues using the MDE Client Analyzer. Highly hands-on experience in Azure Security, including creating playbooks, runbooks, and automation rules, as well as implementing data connectors and onboarding agents. Configure and manage dashboards, notebooks, data connectors, and playbooks in Azure Sentinel. Hunt security threats using Azure Sentinel. Hands-on experience in the installation, configuration, and management of Microsoft Exchange Servers 2016 and above. Experienced in creating conditional access policies and fine-tuning the ASR rules in Defender 365 and Intune. Experienced in managing the Intune administrator console and creating group policies. Good hands-on experience in creating use cases and custom detection rules in Defender and Azure Sentinel by using the KQL language. Hands-on experience (L2 level) in support, implementation, configuration, and management of EDR/AV solutions (EDR/AV solutions such as CrowdStrike and Symantec AV). Implemented conditional access policies and integrated Intune with Azure Active Directory for enhanced security and user authentication. Experience in handling the threat adversaries reports and extracting the IOC's to block in endpoint level and from firewall. Good hands-on experience in onboarding Windows Server 2016 R2 and 2019 servers using Defender XDR and CyberArk. Good hands-on experience in creating virtual machines, deploying endpoint agents on them, and managing IAM roles in an AWS environment. Experienced in creating PIM roles and managing the RBAC roles using Sentinel. Knowledge of Group Policy Objects, Active Directory security and compliance configurations, and migrating to the Intune administrator console. Experience in initiating vulnerability scans on end devices and servers for automated reports using Rapid7. Experience in vulnerability assessments. Evaluate and prioritise identified vulnerabilities for remediation by collaborating directly with customers. Ensuring Data Loss Prevention (DLP), Information Barriers, Information Protection, and Insider Risk Management are effectively configured and monitored. Experienced in creating policies and deploying the agents using the rapid 7 insight VM and performing schedule and manual scans using vulnerability management tool. Monitored regulatory compliance across cloud workloads using built-in compliance standards such as ISO 27001, PCI-DSS, and NIST. Experience in AIR (Automated Investigations and Remediation) policies, and their implementation. Proven experience in designing and implementing data governance solutions using Microsoft Purview. Experienced in performing the manual scans and scheduled scans to find out the known CVE's and pushing the patches accordingly. Experience in creating and maintaining the daily, weekly, and monthly reports of device health status by using Defender ATP. Configured and optimised Microsoft Defender for Endpoint to enhance protection against malware, ransomware, and advanced threats. Taking the appropriate action based on advisories, IOCs, identifying threat actors using Mitre ATT&CK, and coordinating with the respective team to block the IOCs. Monitoring, analysing, and responding to infrastructure threats, vulnerabilities, and risks. Collecting the logs of all the Windows, Linux, and network devices, and analysing the logs to find suspicious activities. Experience in handling and deploying the Defender agents onto servers to onboard into Defender, and troubleshooting agent connectivity issues using the MDE Client Analyser. Experience in creating Log Analytics workspaces, creating conditional access policies, and creating detection rules using Defender 365 and Azure Sentinel. Experience in working on host isolation and advanced threat analysis using EDR, Microsoft Defender ATP.