Gayatri Kende

Security Analyst L1

WNS

Jun 2024 - Present

Perform 24x7 real-time security monitoring and alert triage using Splunk ensuring timely identification of security incidents and threats. Analyze and investigate security alerts, logs, and correlated events from multiple sources including firewalls, IDS/IPS, endpoints, and cloud platforms. Monitor and respond to security alerts from integrated tools including CrowdStrike Falcon (EDR), Zscaler (Web Security), Mimecast (Email Security), Palo Alto Networks (Next-Gen Firewall), and Azure Entra ID to detect, analyze, and mitigate threats. Perform initial triage, validation, and severity classification of incidents, ensuring timely escalation to L2/L3 teams as per SLA. Investigate phishing, spam, and email-based attacks by analyzing email headers, attachments, and malicious URLs, and initiate remediation actions such as blocking domains, IPs, and senders. Conduct endpoint threat analysis using EDR tools to identify malware, suspicious processes, and unauthorized activities, ensuring quick containment. Assist in threat hunting activities by identifying Indicators of Compromise (IOCs) and abnormal patterns across enterprise environments. Create, update, and manage incident tickets in ServiceNow, ensuring proper documentation, tracking, and closure. Support SIEM operations by monitoring dashboards, reviewing correlation rules, and reducing false positives through tuning. Monitor web security threats, malware activity, and unauthorized access attempts, ensuring proactive detection and response. Perform daily health checks to ensure availability and integrity of security tools and log sources. Prepare and share shift-wise, daily, weekly, and monthly reports covering security alerts, incidents, trends, and risk posture. Follow incident response playbooks and SOPs to ensure standardized and efficient handling of security events.