Uddhav Kirolkar

Security Operations Center (SOC) & Monitoring

Accenture

3 Years ago - Present

Monitored and investigated security alerts across endpoints, networks, and cloud environments in a 24×7 SOC using Splunk and IBM QRadar; consistently met SLA targets for alert triage and incident closure. Performed real-time Alert Triage, Incident Investigation, and Threat Detection; improved alert prioritisation workflows to reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). Investigated security events including phishing, malware, ransomware, brute-force attacks, account compromise, privilege escalation, and insider threats. Conducted in-depth Phishing Analysis using Mimecast Email Gateway — reviewed quarantine queues, analysed email headers, validated SPF/DKIM/DMARC, and performed URL detonation and attachment sandboxing. Investigated endpoint alerts using CrowdStrike Falcon and Microsoft Defender for Endpoint; performed full EDR triage including process execution, registry analysis, persistence mechanisms, and lateral movement detection. Performed log analysis from firewalls, IDS/IPS, Active Directory, VPN, and web proxies to identify Indicators of Compromise (IOCs) and attack patterns. Correlated events with Threat Intelligence feeds, OSINT sources, and MITRE ATT&CK techniques to enrich incident context and improve threat classification accuracy. Managed full Incident Lifecycle in ServiceNow — creation, categorisation, prioritisation, escalation, documentation, stakeholder communication, and closure. Conducted proactive Threat Hunting to identify anomalous behaviour and potential compromises across endpoints, network traffic, and cloud environments. Performed IOC enrichment using VirusTotal, AbuseIPDB, Any.run, and Hybrid Analysis to support incident investigations. Assisted in SIEM Rule Tuning and detection logic optimisation to improve alert fidelity and reduce false positives. Monitored Microsoft Azure, Azure AD, and Microsoft 365 for misconfigurations, suspicious login patterns, and cloud security risks. Prepared incident reports, security dashboards, and executive summaries for management on a daily, weekly, and monthly cadence. Supported SOC alignment to MITRE ATT&CK, NIST CSF and GDPR compliance requirements.