Vishnu Kerla

Security Analyst

Cognizant

Sep 2021 - Present

Analysis of Phish emails reported by users to identify the type of attack, and take immediate remediation. Experience with system security concepts, tools, implementation, DLP, CASB, and integration with various data sources and application stacks. Implemented data classification and labelling policies using Sensitivity Labels and Auto-Labelling to protect sensitive information and meet compliance requirements. Experienced in examining suspicious emails for malicious content, and providing recommendations on remediation actions using Office 365. Good understanding of Azure Active Directory, Azure MFA, and conditional access. Experience in providing end-to-end support to enterprise counterparts, identifying the root cause of sophisticated enterprise initiatives, with endpoint security solutions such as Microsoft Defender ATP. Hands-on experience in analyzing the device timeline logs and pulling reports by using advanced hunting in KQL. Working experience in a SOC environment with hands-on experience using the SIEM Splunk tool, which includes log analysis, fine-tuning existing correlation rules to reduce false positives, and responding to incidents. Experience in creating runbooks, SOPs, and documents supporting the Security Operations. Experience in AIR (Automated Investigations and Remediation) policies and their implementation. Taking the appropriate action based on advisories, identifying IOCs, recognising threat actors using MITRE ATT&CK, and coordinating with the respective team to block the IOCs. Monitor, respond to, and analyse trends in workstations, servers, and security-related events. Perform daily, weekly, and monthly scheduled tasks for Defender ATP. Experienced in writing correlation rules with respect to KQL and SPL languages.