Alluri Gayathri
Security Engineer
About
Security Engineer with around 6 years of experience in security engineering, SIEM, XDR, EDR, SOAR, endpoint security, cloud security, DLP, and vulnerability management. Hands-on experience in implementing, configuring, administering, and integrating enterprise security platforms, including Microsoft Defender XDR, Microsoft Sentinel, Splunk Enterprise Security, CrowdStrike Falcon, Zscaler, and AWS security services. Skilled in detection engineering, log onboarding, security policy management, automation, threat investigation, incident response, and security infrastructure operations. Experienced in providing L2/L3 engineering support and maintaining 24/7 security operations across enterprise environments.
Skills & Expertise (29)
Work Experience
Security Engineer
Infosys (SRS Infoway)
Aug 2024 - Present
Strong understanding of security tools and processes such as SIEM, IDS, XDR, SOAR, malware analysis, attack simulation tools, vulnerability scanners, etc. Integrate threat intelligence feeds with security platforms to automate IOC enrichment and investigation workflows. Design and maintain Microsoft Sentinel playbooks using Logic Apps to automate incident enrichment, IOC validation, notification, and response workflows. Blocking and enabling the warning/unsecured smart screen alerts for the end users for the detected phishing URLs, malware files, and IPs on Defender. Experience in creating endpoint health check reports, vulnerability reports, and creating SOPs according to the latest trends. Taking the appropriate action based on advisories, IOCs, identifying threat actors using MITRE ATT&CK, etc., and coordinating with the respective team to block the IOCs. Configure and manage dashboards, notebooks, data connectors, and playbooks in Azure Sentinel. Hunt security threats using Azure Sentinel. Experience in troubleshooting Zscaler client connector issues, and ZIA website access. Strong knowledge and professional experience in central logging, log management, and Splunk SIEM architecture. Implemented Microsoft Entra ID (Azure AD) Conditional Access policies and integrated Microsoft Intune to strengthen identity security, device compliance, and secure user authentication. Collaborated with global security teams to investigate, contain, and resolve critical Priority-1 (P1) security incidents. Performed onboarding and offboarding of Windows Server 2016 and 2019 environments to Microsoft Defender for Endpoint, including agent deployment, configuration, health validation, and troubleshooting server-level connectivity and onboarding issues. Experience in Data Analytics, Advanced Data Analytics, Visualisation, Advanced Visualisation, Dashboard Customisation, and Advanced Dashboard Customisation in Splunk. Configured and managed Microsoft Defender SmartScreen policies to block or warn users about malicious and suspicious phishing URLs, malware downloads, and unsafe web content. Analyse malicious campaigns and evaluate the effectiveness of security technologies. Hands-on experience in creating use cases and custom detection rules using the KQL and SPL languages. Created cloud playbook which helped the monitoring team members to work on the alerts and escalate the true positives. Investigating and monitoring network traffic, IDS, firewall, and endpoint security logs using Splunk ES. Insider threat and APT detection, or understanding and differentiation of intrusion attempts and false alarms. Managing the PIM and PAM access using the Azure Entra admin centre. Leading operations and monitoring security components 24x7, identifying real-time alerts, events, and log analysis, and investigating incidents on a daily basis for a better workflow environment. Investigate malicious phishing emails, domains, and IPs using open source tools, and recommend proper blocking based on analysis. Continuously monitoring and interpreting threats using the IDS and SIEM tools. Monitoring triage of insider threat and User Behavioral Analytics (UBA) via spreadsheet by using the Tableau tool, creating reports and dashboards, and fine-tuning rules (alert fine-tuning). Analyse and investigate alerts in the SOC monitoring tool to report any abnormal behaviours, suspicious activities, or traffic anomalies.
Security Associate
Amazon
Feb 2020 - Jun 2024
Perform security platform health monitoring, troubleshooting, and optimisation to ensure high availability and operational efficiency. Strong hands-on experience with cloud providers (AWS, GCP), virtual machines, and onboarding those instances into Defender 365. Good hands-on experience in analysing the risky user's behaviour in Azure AD, revoking the user sessions, and resetting the password if required. Analyse malware, phishing campaigns, command-and-control activity, and lateral movement indicators during incident investigations. Engineer and optimise detection use cases using Kusto Query Language (KQL) to improve threat visibility and reduce false positives. Develop and fine-tune security detections, alert logic, and correlation rules based on MITRE ATT&CK techniques and organisational threat landscape. Automate repetitive SOC tasks to improve incident response efficiency and reduce Mean Time to Respond (MTTR). Perform threat hunting activities leveraging KQL, Defender Advanced Hunting, and Splunk SPL to identify advanced threats and suspicious behaviours. Execute containment actions including device isolation, file quarantine, IOC blocking, and remediation through Microsoft Defender XDR. Investigate endpoint, identity, email, and cloud security incidents using Microsoft Defender XDR and Splunk Enterprise Security. Monitored security events from SIEM, EDR, endpoint, identity, and email security solutions to identify potential security threats. Performed initial triage, alert validation, incident categorization, prioritisation, and escalation based on organisational SLAs. Investigated phishing emails by analysing email headers, URLs, attachments, sender reputation, and Indicators of Compromise (IOCs). Collaborate with infrastructure, cloud, and application teams to implement security controls and strengthen the organization's security posture. Collaborated with L2/L3 analysts and engineering teams during critical security incidents and major incident response activities. Configured and managed DNS Security policies to block access to malicious domains and command-and-control infrastructure. Performed log analysis using Zscaler Analytics and integrated logs with SIEM platforms for centralised security monitoring. Configured and managed URL Filtering, Cloud Firewall, SSL Inspection, and Web Security policies based on organizational security requirements. Manage Microsoft Defender for Office 365 policies for anti-phishing, anti-malware, Safe Links, Safe Attachments, and email threat protection.
Education
B.S.C: Computers - St Ann's College for Women
- 2018 · Afghanistan
Certifications
No certifications added yet
Interested in this developer?
Profile Score Breakdown
Profile Overview
Skills (29)
Click a skill to find developers with the same skill
