Satham hussain Mohamed gani

• Handled and investigated security incidents, including malware infections, data breaches, and
unauthorized access attempts escalated by L1 . Contributed in-depth analysis of alerts and provided
feedback.
• Created use cases and implemented rules on EDR, SIEM, and Azure Sentinel by analyzing threat
advisories and using MITRE framework to identify uncover threats.
• Performed red team exercises using BAS tools, prepared reports on successfully penetrated hosts,
and implemented detection capabilities in SIEM and other detection devices.
• Experienced in managing and responding to security alerts generated by Azure Sentinel and
Microsoft Defender for XDR.
• Built advanced security use cases and performed threat hunting using KQL and developed
playbooks to mitigate real-time attacks with Azure Logic Apps.
• Monitored brand protection alerts and raised requests to the support team for takedown of squatting
domains. Handled web page change detection tool alerts and took necessary actions to address
webpage changes.
• Analyzed and triaged alerts from multiple security technologies - NDR, IPS, EDR, SIEM, ESA,
WAF, and cloud security - validated signatures and attack patterns, performed proactive threat
hunting, authored investigation reports, and developed detection/use-case rules applied across
security controls.
• Actively supported threat-modeling initiatives by correlating SOC investigations to identify control
gaps, logging deficiencies and lateral-movement paths. Then provided prioritized, actionable
recommendations to improve detection coverage and reduce organizational risk

• Monitored and investigated alerts from SIEM tools, EDR, and other security devices. Managed
alerts by closing, adding notes, and reporting using XSOAR.
• Performed IOC-based threat hunting, prepared executive summary reports for the internal team,
and ensured the blocking of collected and shared IOCs across all security devices.
• Raised requests through FireEye support portal for false positive alerts and provided case details
and recommendations.
• Reviewed vulnerability advisory reports from Cyber Threat Intelligence and shared with relevant
teams for patching.
• Monitored and analyzed threat intelligence feeds and sources to stay informed about the latest
threats and vulnerabilities
• Analyzed and investigated phishing emails detected by ESA or reported by users. Performed URL
and attachment analysis using sandbox solutions (Any Run, FireEye AX) then Blocked identified
phishing emails in ESA by using regex queries.
• Conducted deep-dive analysis of threat intelligence feeds: collected and validated IOCs from open
sources, commercial feeds, dark-web forums, and internal telemetry. Enriched indicators and
mapped adversary TTPs to MITRE ATT&CK to prioritize detection efforts and integrated feeds into
SIEM / TIP / EDR, correlated TI with SIEM alerts to fine tune rules, reduce false positives, and
improve proactive detection and response.

• Continuously monitor abnormal log activity and handle alerts 24/7, conduct thorough investigations,
and adhere to the incident response process.
• Provide support, investigate, document, and perform investigations of incidents that occur in client
facing and corporate environments
• Developing Standard Operating Procedures (SOP) and Incident Response (IR) Playbooks, while
maintaining accurate and up-to-date documentation of security policies, procedures, and incident
reports
• Handling EDR alerts for performing Monitoring, analysis, containment and mitigation on the hosts.
Blocking the Hashes and Creating rules to detect future attacks.

• Worked on Various Cyber Security solution. Monitoring & Analysis of security Incidents in 24/7
environment and take quickest steps to identify & mitigate the suspicious potential attack attempts.
• Initiate, Track, Root cause finding and Forensic analysis whenever required for the incident
recommendations and advisories to various stakeholders in order to restrict damage caused by
unknown threats in organizations network.
• Developing and implementing use cases based on client requirements, and creating rules to trigger
alerts for active monitoring
• Preparing reports for clients, supporting client on calls, attending client meetings to provide inputs
for project on going status & future enhancement. Enforce incident response Service Level
Agreement (SLA).
• Integrated various log sources with SIEM, ensuring logs report accurately, and performed daily log
source health checks.

• Monitored and correlated log events and performed forensic analysis of raw logs to ensure network
security compliance.
• Integrated network devices with RSA Envision for seamless log forwarding. Tracked anomalous
behavior and user activity to gain deeper visibility into organizational security.
• Enhanced security operations by profiling assets and matching them against the national
vulnerability database, reducing false positives and prioritizing high-risk assets.
• Installed, configured, and managed McAfee EPO (DLP) and Symantec Endpoint Protection.
• Initiated vulnerability assessments (VA) for assigned assets, analyzed reports, and collaborated
with relevant teams to remediate vulnerabilities.