Rishav Raj

SOC Analyst — Tier 1

CubeLogic

Sep 2023 - Present

Monitored and correlated events across SIEM (Splunk, Wazuh), IDS/IPS logs, network traffic, and endpoint/AV consoles for 500+ endpoints to determine true incidents, cutting mean-time-to-detect by 25% with zero security breaches. Responded to security incidents and investigation requests within defined SLA targets, triaging and containing advanced-vector activity, including DDoS, brute-force, and ransomware attempts, under ITIL process with 99.5% SLA compliance over 2.9 years. Conducted forensic-style examination of system logs, applications, and network traffic (Wireshark) to locate evidence, performed RCA for escalated incidents, and updated the team's knowledge base and 10+ SOC playbooks mapped to MITRE ATT&CK. Tuned Splunk + Wazuh correlation rules and IDS/IPS thresholds based on threat feeds, reputation data, and investigation findings, reducing false positives and providing tuning recommendations during team reviews. Delivered definitive verdicts on 100% of escalated phishing cases by inspecting SMTP headers, SPF/DKIM/DMARC records, and MX anomalies across POP3, IMAP, and webmail channels, and endpoint/AV console findings. Monitored threat intel feeds and dark-web sources to stay current on emerging threats and attack vectors, correlating IOCs across multiple sources to drive proactive containment ahead of disclosure. Built dashboards and translated Splunk, Wazuh, and SaaS telemetry into concise briefings and remediation recommendations for SOC managers, technology teams, and C-level stakeholders across rotational 24/7 coverage.