T.V.S Tejaswini

SOC Analyst

Infosys

Jul 2022 - Present

Working on the Splunk, Qradar, Azure SIEM (console & web console) providing operations support at the Security Operations Center for different member firms. Provided 24x7 Security Operations Center (SOC) monitoring and operational support across multiple SIEM platforms including Splunk, IBM QRadar, Azure Sentinel, and LogRhythm (console & web). Monitored and analyzed security alerts generated from SIEM, IDS/IPS, firewalls, routers, switches, servers, databases, applications, wireless devices, and Tripwire. Performed real-time threat detection, analysis, and correlation by investigating logs and identifying anomalous behavior indicative of cyber threats. Conducted threat analysis and incident validation through deep log inspection, research, and behavioral analysis to confirm true security incidents. Monitored Windows security logs to detect login failures, account lockouts, and privilege abuse based on defined thresholds. Analyzed Tripwire logs to identify critical file integrity violations on Windows servers. Investigated IPS and firewall logs to detect external attacks, intrusion attempts, and suspicious network traffic. Collected, normalized, and analyzed logs from network, security, and infrastructure devices to identify malicious or abnormal activities. Created and optimized filters, inline filters, active channels, dashboards, and data monitors to enhance visibility and streamline investigations. Displayed security event data using customized dashboards and reports to highlight threats, trends, and operational metrics. Investigated phishing and spam incidents using Microsoft O365 Defender, notifying end users and coordinating remediation. Managed the complete incident lifecycle including identification, triage, containment, root cause analysis, remediation recommendations, and closure. Created and managed security incidents in ServiceNow / Service Desk, ensuring resolution within defined SLA timelines and providing regular status updates. Performed system health checks including SIEM platform health, connector status, and log ingestion integrity; reported issues to administration teams. Prepared daily, weekly, and monthly SOC reports covering incident activity, threat trends, and system health metrics. Supported vulnerability and infrastructure threat monitoring, identifying potential risks and recommending preventive and corrective controls. Participated in client review meetings, weekly and monthly operational calls, providing incident summaries, risk posture updates, and process improvements. Reviewed and maintained SOC policies, procedures, and operational documentation. Supported ISO 27001 compliance activities, including ISMS evidence sampling, document reviews, field reviews, and implementation of audit recommendations. Coordinated with cross-functional teams during high-severity security incidents to ensure rapid containment and resolution.