Vaibhav Todkar

SOC Analyst (L1)

Mumbai, India 3+ yrs exp 86 · Excellent

About

Results-driven SOC Analyst with 3+ years of experience in Security Operations Center (SOC) environments, specializing in 24x7 security monitoring, incident detection, threat analysis, and incident response. Proficient in SIEM platforms (Splunk, IBM QRadar, Microsoft Sentinel), EDR tools (CrowdStrike, Microsoft Defender for Endpoint), phishing and malware analysis, vulnerability assessment, and threat hunting using the MITRE ATT&CK framework. Skilled in log analysis, IOC identification, incident ticket management (ServiceNow), and SLA-driven escalation. Proven track record of collaborating with global SOC teams to reduce dwell time, strengthen detection capability, and safeguard organizational assets.

Skills & Expertise (38)

Splunk Advanced

8.1/10

Years Exp

Phishing Email Analysis Advanced

8.0/10

Years Exp

Incident Response Advanced

8.0/10

Years Exp

IBM QRadar Intermediate

7.5/10

Years Exp

MITRE ATT&CK Intermediate

7.5/10

Years Exp

Threat Hunting Intermediate

7.5/10

Years Exp

Microsoft Sentinel Intermediate

7.5/10

Years Exp

CrowdStrike Falcon Intermediate

7.5/10

Years Exp

NIST Cybersecurity Framework Intermediate

7.0/10

Years Exp

Firewalls Intermediate

7.0/10

Years Exp

Whois SSL Azure Active Directory Microsoft Entra ID Nessus Nmap VirusTotal AbuseIPDB URLScan.io IPvoid Incident Documentation Windows Sandbox ServiceNow Security Reports HTTPS HTTP DNS Security WAF Proxy IPS IDS UDP IP TCP Mimecast SLA Compliance IOC Analysis Microsoft Defender for Endpoint

Work Experience

Information Security Analyst – L1

Inspira Enterprise India

Jun 2023 - Present

Monitor and analyze security alerts in real time within a 24x7 Security Operations Center (SOC) using Splunk SIEM. Analyze security logs from Active Directory, firewalls, IDS/IPS, EDR, email security, and web security solutions to detect anomalous activity. Investigate security incidents, validate alerts, and classify True Positive / False Positive events. Perform log analysis, phishing email analysis, and malware analysis as part of initial threat investigation. Create, update, and manage incident tickets in ServiceNow, ensuring SLA compliance throughout the incident lifecycle. Monitor endpoint security alerts using Microsoft Defender (EDR) and CrowdStrike, supporting incident response activities. Identify Indicators of Compromise (IOCs) including malicious IPs, domains, URLs, file hashes, and suspicious processes. Participate in phishing email investigations and contribute to user awareness and preventive controls. Follow incident response procedures and SOPs to ensure consistent and repeatable outcomes. Conduct vulnerability assessments using industry-standard tools to identify weaknesses across endpoints, networks, and applications. Apply the MITRE ATT&CK framework to identify attack patterns and improve SOC detection capabilities. Evaluate EDR tool findings to identify risks and support threat/malware remediation. Collaborate with cross-functional and global SOC teams to support investigations and remediation activities. Maintain accurate documentation of incidents, investigation steps, and security recommendations. Ensure timely detection, analysis, containment, and escalation of cybersecurity incidents in line with client SLAs. Prepare and share daily, weekly, and monthly security reports covering alerts, incident summaries, failed logons, antivirus status, and security trends.