Nov 2016 – Nov 2018 · 2 yrs · Bangalore

• The core responsibility areas include working on SIEM (Security Information and Event Management) tools and techniques in order to help the organization in protecting its confidential and proprietary information from being leaked.
• IPS Administration: Policy update, IPS version upgrade, Blocking of Malicious IPs as per analysis is a part of my job.
• Vulnerability Assessment using Nessus
• Splunk- Splunk enterprise security:
• Perform analysis of data across the organization to identify and contain IT security incidents.
• Monitor and analyse un-authorized user activity across the organization.
• Communicate with appropriate stakeholders in the organization to help ensure the identified security incidents get resolved.
• Ensure that all the services such as log collection, vulnerability assessment, intrusion detection nd prevention are available and running.
• Ensure that critical systems, which are required to send logs to the central log collection solution are reporting as expected.
• Troubleshooting and fine tuning are also part of my job.
• Different device used are McAfee ePo, Bit9, SNORT IDS and IPS, Nagios, Mandiant for sending logs to Splunk for analysis.
• Security Administration -
• Perform Security Administration tasks in Security Center.
• Checking Nessus and PVS status on servers
• Performing remediation scans
• Verifying authenticated Scans
• Upgrading Nessus on GID
• Verifying patch compliance
• Installing Licenses, scanners and Zones

Oct 2014 – Nov 2016 · 2 yrs 1 mo · Bengaluru Area, India

• The core responsibility areas include working on SIEM (Security Information and Event Management) tools and techniques in order to help the organization in protecting its confidential and proprietary information from being leaked.
• RSA SA is the tool that I am working on. It triggers alerts based on defined signature and rules. Here I am responsible for creating cases and analyzing them and resolving them with a proper resolution detail. Further, escalations of certain CSIRT level cases are also a part of my job. Apart from alert analysis, I am also working on logs, such as Firewall logs, Intrushield logs, Proxy logs.
• NSM IDS (Network Security Management- Intrusion Detection System), is another tool on which I am working. It is a Real Time Monitoring tool. Alerts are triggered through a set of pre-defined rules. On these alerts also I do the analysis after creating cases.
• FIREEYE, another tool for monitoring Zero Day Attack as well as signature based alerts.
• Working on Imperva’s database security solutions, securing sensitive data stored in databases against compromises of their confidentiality, integrity and availability.
• Handling LIVE Queues in RSA SA which take data feeds from various network devices of the Data Centers of the Bank for notifying on network related issues DDOS attacks on Bank’s data centers, with an SLA of 5-15 minutes from their arrival in the queue of the tool with proper escalation procedures.
• Working on Arbor peak flow tool for monitoring Data Intake and Outflow from the bank’s network along with health status of various devices in the network.
• Working on 3 different Arbor peak flow tools, Verizon, AT&T and Internal Arbor (SP1).
• Providing Web Proxy Exceptions to the Bank’s associates for various blocked IP’s based on business justification and Web IP’s Threat Category and rating.