Pavan Bhoyar

Cybersecurity Analyst

Tata Consultancy Services (TCS)

May 2024 - Present

Conduct L1/L2 SOC activities including alert triage, investigation, and escalation using Microsoft Sentinel (SIEM) utilizing Kusto Query Language (KQL), SentinelOne (EDR), and Microsoft Defender for Endpoint. Analyze security alerts from SIEM and EDR tools to isolate potential threats, identify false positives, and detect suspicious behavior. Investigate endpoint incidents using SentinelOne to execute threat analysis, remediation actions, root cause identification and blocking IOCs. Monitor and maintain security posture for 90,000+ endpoints, consistently ensuring ~98% compliance. Correlate logs from multiple enterprise sources (EDR, SIEM, endpoints) to accelerate incident response and threat detection. Administer SentinelOne EDR systems, managing policy configuration, remediation actions, exclusions, user management, and log analysis. Troubleshoot EDR onboarding issues, agent failures, and telemetry gaps to guarantee complete visibility. Support vulnerability management processes using Qualys VMDR, including agent monitoring, reporting, and remediation tracking. Prepare daily, weekly, and monthly security reports and develop knowledge base articles, SOPs, and offline playbooks to support operational consistency. Manage incident tickets and change requests through BMC Remedy, BMC Helix, and Jira environments. Collaborate with cross-functional teams to refine detection rules and optimize incident response processes & agent deployment.