Wajid Yousuf

SOC Analyst

Srinagar, India 0+ yrs exp 86 · Excellent

About

SOC Analyst experienced with Splunk SIEM, Active Directory, AWS and Microsoft Sentinel. Skilled in alert triage, log analysis, threat intelligence, and incident response. Experienced in reconstructuring attack timelines, correlating multi-source telemetry, and mapping adversary activity to the MITRE ATT&CK framework.

Skills & Expertise (31)

Log Analysis Intermediate

6.5/10

Years Exp

Cyber Kill Chain Intermediate

6.5/10

Years Exp

MITRE ATT&CK framework Intermediate

6.5/10

Years Exp

IOC extraction Intermediate

6.5/10

Years Exp

Splunk Enterprise Security Intermediate

6.5/10

Years Exp

Splunk SPL Intermediate

6.5/10

Years Exp

Log Aggregation Intermediate

6.5/10

Years Exp

EDR Concepts Intermediate

6.5/10

Years Exp

Packet Analysis Intermediate

6.5/10

Years Exp

Network Traffic Analysis Intermediate

6.5/10

Years Exp

Security Event Correlation Intermediate

6.5/10

Years Exp

Vulnerability Assessment Intermediate

6.5/10

Years Exp

Vulnerability Management Intermediate

6.5/10

Years Exp

Threat Management Intermediate

6.5/10

Years Exp

SIEM Monitoring Intermediate

6.5/10

Years Exp

Incident detection Intermediate

6.5/10

Years Exp

Alert Triage Intermediate

6.5/10

Years Exp

SPL queries Intermediate

6.5/10

Years Exp

Sentinel Intermediate

5.5/10

Years Exp

AWS Intermediate

5.5/10

Years Exp

AbuseIPDB Intermediate

5.5/10

Years Exp

VirusTotal Intermediate

5.5/10

Years Exp

GitHub Intermediate

5.5/10

Years Exp

Git Version Control Intermediate

5.5/10

Years Exp

Bash Intermediate

5.5/10

Years Exp

PowerShell Intermediate

5.5/10

Years Exp

Python Intermediate

5.5/10

Years Exp

Tcpdump Intermediate

5.5/10

Years Exp

WIRESHARK Intermediate

5.5/10

Years Exp

Snort Intermediate

5.5/10

Years Exp

KQL queries Intermediate

5.5/10

Years Exp

Work Experience

SOC Analyst

Active Directory SOC Detection Lab(AWS)

Mar 2026 - Present

Deployed a cloud-hosted Active Directory lab on AWS (Windows Server DC + domain joined endpoint) with Sysmon telemetry and centralized log ingestion into Splunk via Universal Forwarders. Simulated realistic attack techniques, including network reconnaissance, account enumeration, brute-force, unauthorized access and investigated correlated Windows and endpoint logs to reconstruct full attack chains. Developed Splunk SPL queries to identify suspicious authentication patterns and lateral movement, mapping attacker behaviour to MITRE ATT&CK techniques. Produced structured investigation reports documenting indicators of compromise, detection gaps, and incident response recommendations with SOC analyst workflows.

SOC Analyst

Splunk Detection Lab

Dec 2025 - Feb 2026

Triaged 462 IDS alerts during a simulated brute-force campaign using Splunk SPL aggregation (stats count by src_ip); extracted IOCs and mapped attacker activity to MITRE ATT&CK (T1046, T1595, T1110, T1078). Reconstructed full attack timeline (Nmap → Gobuster → Hydra → valid access) and validated containment via Sysmon endpoint analysis, confirming no persistence or lateral movement. Authored structured incident reports (initial vector, IOCs, containment/remediation) and created detection rules/dashboards to speed analyst investigations.