afroz md

SOC Analyst

Kotak Mahindra Bank

Apr 2024 - Jan 2026

Monitored and analyzed security events and alerts using SIEM platforms to identify potential security incidents and policy violations. Performed 24x7 security monitoring, alert triage, and incident investigation across enterprise environments. Investigated alerts generated by SIEM, XDR, EDR, email security, and endpoint security solutions. Conducted phishing email analysis by examining email headers, URLs, attachments, sender reputation, and indicators of compromise(IOCs). Identified, validated, and escalated security incidents based on severity, impact, and organizational SLAs. Performed log analysis across Windows, Linux, Active Directory, VPN, Firewall, Proxy, DNS, Web, and Endpoint logs. Investigated malware, ransomware, brute-force attacks, suspicious logins, command-and-control (C2) communications, and lateral movement activities. Correlated security events from multiple log sources to detect complex attack patterns and reduce false positives. Created, updated, and managed incident tickets using ITSM tools while maintaining complete documentation throughout the incident lifecycle. Collaborated with Incident Response, Network, Endpoint, Cloud, and Infrastructure teams during security investigations and remediation activities. Supported containment, eradication, and recovery activities during cybersecurity incidents. Performed IOC enrichment using threat intelligence platforms and open-source intelligence (OSINT) tools. Assisted in threat hunting activities to identify hidden threats and suspicious behavior within the environment. Monitored endpoint activities using XDR/EDR solutions and investigated endpoint detections. Reviewed firewall, IDS/IPS, VPN, DNS, Proxy, and email gateway logs to identify anomalous or malicious activity. Performed initial malware analysis using file hashes, sandbox reports, and threat intelligence sources. Validated security alerts by differentiating true positives from false positives to minimize alert fatigue. Documented investigation findings, root cause analysis, and recommended remediation actions. Prepared daily, weekly, and monthly SOC operational reports, incident metrics, and security dashboards. Supported SIEM use-case validation, alert tuning, and optimization to improve detection accuracy. Maintained compliance with incident response procedures, security policies, and operational playbooks. Worked with MITRE ATT&CK; framework and Cyber Kill Chain methodology to classify attacker techniques and tactics. Participated in vulnerability remediation tracking by coordinating with infrastructure and application teams. Stayed updated on emerging cyber threats, vulnerabilities, and attack techniques to improve detection capabilities. Contributed to continuous improvement initiatives by recommending enhancements to SOC processes, monitoring rules, and incident response workflows.