Harish

SOC Analyst

Sonata Software

Jan 2022 - Oct 2025

Monitored security events and alerts using Microsoft Sentinel and IBM QRadar in a 24×7 Security Operations Center. Investigated security incidents related to malware, phishing, ransomware, brute-force attacks, suspicious logins, endpoint compromise, and account takeover. Performed incident triage, investigation, containment, eradication, recovery, and closure following established incident response procedures. Investigated endpoint threats using CrowdStrike Falcon and Microsoft Defender for Endpoint. Conducted phishing investigations using Proofpoint and Microsoft Defender for Office 365. Developed and optimized SIEM detection rules and KQL queries to improve threat detection and reduce false positive alerts. Performed threat hunting activities using security logs, endpoint telemetry, and threat intelligence feeds. Mapped attacker techniques using the MITRE ATT&CK Framework and Cyber Kill Chain methodology. Conducted malware analysis, IOC validation, and root cause analysis for confirmed security incidents. Managed incidents through ServiceNow while ensuring SLA compliance and accurate documentation. Performed vulnerability assessments using Tenable Nessus and coordinated remediation with infrastructure teams. Worked with Active Directory administrators to disable compromised user accounts and reset credentials. Coordinated with firewall and network teams to block malicious IP addresses and implement security controls. Prepared daily, weekly and monthly SOC reports highlighting incident trends and security posture. Escalated high-severity incidents to Tier-2 analysts with detailed investigation findings and recommended actions. Participated in client security review meetings and supported continuous improvement of SOC operations.