MEHROOF KM

« Acted as the primary contact for client security incidents in an MSSP environment.
+ Analyzed, escalated, and assisted with remediation of critical security incidents.
+ Communicated threat severity and remediation advice to customers through clear updates.
+ Developed SIEM use cases and detection rules based on client needs.
« Fine-tuned security alerts following industry best practices.
+ Conducted threat hunting and log correlation for incidents.
+ Engaged with customers for updates, reports, and ad-hoc requests.
+ Monitored system vulnerabilities using a vulnerability management solution.
« Participated in NSCA/QCB cybersecurity resilience dri for the customer.
+ Provided training and knowledge transfer to L1 and new analysts.
« Monitored and validated SIEM alerts (LogRhythm), prioritizing incidents by severity.
+ Conducted initial investigations and enrichment for event disposition.
+ Collected and correlated logs from various sources to establish incident timelines.
+ Documented findings in IR templates and maintained evidence and case notes.
+ Escalated complex cases to L2/L3 with context and recommendations.
+ Performed IOC sweeps and basic threat hunting using SIEM queries.
+ Monitored log source onboarding and addressed parsing etrors.
+ Contributed to alert tuning based on false-positive analysis.
« Prepared shift handover notes and participated in SOC metrics reporting.
« Followed SOC playbooks, SLAs, and quality standards; engaged in QA reviews.
« Participated in tabletop exercises and ongoing training to enhance skills.