Bipul Agrawal

• Significant experience in supporting and maintaining F5 Big-IP modules (LTM, ASM,
APM) which includes set-up, maintenance, upgrades.
• Extensive experience with Big-IP LTM and ASM modules in a large, shared
environment.
• Extensive practical knowledge on Splunk and its components along with CIM
modulation, Add-on/App creation/customization, troubleshooting and maintenance.
• Experience in OPSWAT Meta-defender, ICAP and central management.
• Experience in various email security gateways which includes Proofpoint, Trustwave,
Symantec Message labs, Mimecast & FireEye EX.
• Experience in managing distributed SEPM environment based across multiple
locations.
• Experience in Symantec Proxy SG.
• Experience in Carbon-Black (Bit9) EDR solution.
• Introductory experience in Palo-Alto Firewall.
• Creation of detailed root cause analysis reports for the relevant stake holders

Management of SIEM Tools (ArcSight and Splunk) which includes but not limited to
Configuration, Implementation, troubleshooting and overall maintenance.
• Extensive practical knowledge on ArcSight ESM, ArcSight Logger, ArcSight
Connectors & Appliance, ArcSight Command Centre & ArcSight Web
• Extensive practical knowledge on Splunk and its components along with CIM
modulation, Add-on/App creation/customization, troubleshooting and maintenance.
• Immense knowledge in F5 ASM - Creation of Virtual Servers, Pools, ASM Policies,
SSL Profiles, F5 Learning, upgrades & maintenance.
• Configuring the F5 BIG-IP APM system as a Security Assertion Markup Language
(SAML) Identity Provider (IDP) to provide inline single sign-on (SSO) for service
providers (SP) not directly reachable by the client.
• Handling Daily operations & troubleshooting issues of email security gateway
(Trustwave, Symantec Message labs, Mimecast & FireEye EX)
• Handling Forcepoint Proxy which includes troubleshooting internet connectivity
issues for users and server subnets by providing least privileged access.
• Troubleshooting, maintenance and upgrades of Symantec Endpoint Protection
Manager & Symantec Protection Engine.
• Endpoint security policies and application control using tools like Carbon Black
Protection.
• Management of multiple Secure-USB Drives and their security policies remotely on
the central management platform for persistent data protection and instant response
to theft or loss.
• Vulnerability assessment and patch management cycles in coordination with asset
owners.
• Management of SSL Certificates which includes creation of CSR, Installation and
Deployment.

Extensive practical knowledge on Splunk and its components along with CIM
modulation, Add-on/App creation/customization, troubleshooting and maintenance.
• Extensive practical knowledge on ArcSight ESM, ArcSight Logger, ArcSight
Connectors & Appliance, ArcSight Command Centre & ArcSight Web.
• Splunk Enterprise Security for notable events and Incident response.
• Development and fine tuning of security use cases for SOC operations.
• Formulate the Incident response and handling process as per the organizational
standard with globally recognized baselines, and handle incident escalation to drive the
RCA.
• Executive and technical reports for management and assess the KPI's
• Incident review and analysis on APT tools like FireEye (NX, EX, CM).
• FireEye CMS, NX & EX - Analyzing Malware call back/object alerts, PCAP files,
performing & troubleshooting Administrative Tasks.
• Malicious email analysis to identify true positive incidents and trigger the incident
response procedure, whilst tuning the false positives.
• Vulnerability assessment and reporting using Nessus and Qualys.
• Log analysis and correlation from various heterogeneous devices i.e., proxy, firewall,
endpoint security, IPS, APT, Threat intelligence feeds.

Preparing incident analysis report with recommendations and impact analysis report
for incidents notified through SIEM (ArcSight) tool.
• Creating of Incidents on Internal ticketing tool (Risk Vision) & continuous follow-up
to resolve the ticket to meet SLA.
• Fine-tuning of alerts and incidents in SIEM tool console for quick response on true-
positive incidents.
• Based on threat advisories, building appropriate rules to monitor indicators of
compromises (IOC) and take follow up from concerns teams for quick response on
handling different types of IOCs.
• Analyzing Web uploads and email sharing to monitoring data leakage Incidents.
• Analyzing SPAM Email’s on CISCO Email Gateway.
• Intrusion attempts captured through consolidated analysis of logs from operating
systems,
• Databases, Network, and security devices with the help of ArcSight SIEM tool.
• Manage 24x7 operations at SOC including securing event monitoring which included
incident
• detection, tracking and analyzing on real time basis, report generation etc.
• Building trend’s (Weekly-Monthly Basis) for highly critical devices and assets for any
anomalies

• Manage 24x7 operations at SOC including security event monitoring which included
incident detection, tracking, and analyzing on real time basis, report generation.
• Collecting, analyzing, and preserving the evidence related to incidents
• Daily reports on use cases and deliver them to Business and other stakeholders.
• Creation of reports, queries and filter for the events that are generated in ArcSight
Console based on severity and priority of the events. Ensure application availability
and SLA adherence.
• Review security-related events, assessing risk and validity, as well as reporting.
• Assist, co-ordinate with the Manager on performing a risk review of the daily security
requests that come from the business.
• Assist, co-ordinate with the Security Incident Handling Team (onsite projects team) in
helping during investigation.
• Potential to bring any possible security threats or violation of Security Policy to the
notice of the Information Security Manager