About
Results-driven Security Analyst with 2.8 years of hands-on experience in Security Operations Center environments. Proven ability to monitor, triage, and investigate security incidents using industry-leading SIEM and endpoint platforms. Adept at detecting threats, analyzing phishing campaigns, and reducing false positives through precise log correlation. Experienced with Microsoft Defender for Endpoint, CrowdStrike Falcon, Splunk, Rapid7, Proofpoint TAP/TRAP, Datadog, and AWS cloud security monitoring (CloudTrail, CloudWatch). Strong working knowledge of the MITRE ATT&CK framework and incident response lifecycle, with a track record of escalating confirmed incidents to L2 with comprehensive investigation reports.
Skills & Expertise (22)
Work Experience
Security Analyst – L1
Foundever
Jan 2022 - Present
Monitored and triaged security alerts from Datadog SIEM, Splunk, and Microsoft Defender for Endpoint, covering endpoint, network, and cloud environments. Performed initial investigation of suspicious activities including malware behavior, unauthorized access attempts, and anomalous user activity. Correlated logs across multiple sources to eliminate false positives and prioritize confirmed security events for escalation. Investigated phishing campaigns using Proofpoint TAP sandbox analysis — examining malicious URLs, attachments, and sender infrastructure. Executed email remediation using Proofpoint TRAP, removing malicious emails from affected enterprise mailboxes post-delivery. Identified and documented IOCs (IP addresses, domains, file hashes) associated with phishing and social engineering attacks. Analyzed AWS CloudTrail and CloudWatch logs to detect suspicious authentication attempts, privilege escalation, and IAM policy misuse. Investigated endpoint alerts using Microsoft Defender and CrowdStrike Falcon — reviewed process trees, command-line execution, and file system activities. Leveraged Rapid7 InsightIDR for vulnerability context during investigations. Detected suspicious Python executions, WAF blocks, and AWS resource anomalies via Datadog and Splunk alert correlation, with cloud security posture checks using CrowdStrike Falcon. Escalated confirmed security incidents to SOC L2 teams with detailed investigation reports, IOC summaries, and recommended containment actions. Maintained accurate incident documentation in ticketing systems, ensuring full audit trails for each investigation.
Education
Bachelor of Engineering (B.E.)
- · Afghanistan
Certifications
CompTIA Security+
· 2026
Interested in this developer?
Profile Score Breakdown
Profile Overview
Availability Details
Relocation
Not Open to Relocation
Skills (22)
Click a skill to find developers with the same skill
