About
Cybersecurity Analyst with 1.6 years of experience in Incident Response. Certified in Splunk Enterprise Security and IBM QRadar, with hands-on experience across security tools including Intrusion Prevention Systems (IPS), antivirus solutions, email security, firewalls, Web Application Firewalls (WAF), and proxy services. Skilled in detecting, analyzing, and responding to security incidents to protect critical organizational infrastructure.
Skills & Expertise (26)
Work Experience
SOC Analyst
EMTECH SOLUTIONS PRIVATE LIMITED
Sep 2024 - Present
Performed 24×7 SOC monitoring, triaging and investigating high-volume security alerts using Splunk Enterprise Security and IBM QRadar SIEM in line with defined SOC SLAs. Managed and maintained IBM QRadar SIEM, including log onboarding, correlation rule tuning, and alert optimization. Investigated security events across Firewall, WAF, IDS/IPS, Antivirus, Proxy, Email Security, and Endpoint platforms to identify anomalies, policy violations, and potential breaches. Conducted phishing and malicious email investigations by analyzing email headers, URLs, attachments, payloads, and file hashes for rapid threat containment. Handled EDR/XDR incidents using CrowdStrike Falcon, SentinelOne, and Microsoft Defender, performing alert analysis, host investigation, containment, and escalation. Analyzed and correlated Indicators of Compromise (IOCs) including IPs, domains, URLs, and hashes using threat intelligence feeds to enhance proactive threat detection. Applied the MITRE ATT&CK framework to map adversary TTPs, improving detection accuracy and strengthening SOC coverage. Tuned SIEM correlation rules and detection logic, reducing false positives by 25% and improving analyst efficiency and response time. Supported the full incident response lifecycle including investigation, containment, eradication, and recovery in collaboration with IT and infrastructure teams. Generated daily, weekly, and monthly SOC reports, including incident summaries, root cause analysis (RCA), and remediation recommendations. Blocked malicious IPs, URLs, and domains using proxy and network security controls to prevent access to harmful resources. Maintained audit-ready incident documentation, timelines, and security briefings for management and client stakeholders.
Education
Electrical and Electronics Engineering - Shri Siddhartha Institute of Technology
2021 - 2024 · Afghanistan
