Neha Khandelwal

Cybersecurity Consultant (SOC Analyst - EDR)

Not specified

Mar 2024 - Present

Worked as a SOC Analyst (L1/L2) within the Endpoint Detection and Response (EDR) team, monitoring enterprise endpoints across the organization for security threats using Microsoft Defender for Endpoint and Microsoft Sentinel. Performed proactive threat hunting and threat analysis across enterprise endpoints, regularly identifying suspicious behaviors and indicators of compromise (IOCs). Conducted log analysis and false positive analysis using EDR/XDR platforms to detect and investigate anomalous activity across the environment. Investigated suspicious command-line activity, PowerShell execution, LOLBins (Living-off-the-Land Binaries), and abnormal process behavior to identify persistence mechanisms and credential theft attempts. Wrote and executed KQL (Kusto Query Language) queries regularly in Microsoft Sentinel for security event investigation, threat detection, and correlation of endpoint alerts. Regularly triaged security alerts, performed phishing analysis, and supported incident response activities including severity classification and detailed security incident documentation aligned with MITRE ATT&CK methodology. Contributed to vulnerability management efforts by flagging endpoint misconfigurations and coordinating remediation with relevant teams.