Phishing & Email Security Operations
Investigated reported phishing emails through sender ID & Domain validation, content analysis, artifact inspection (URLs, attachments, QR codes, unwanted file download automatically), and email header analysis.
Identified spoofing, social engineering tactics, and malicious infrastructure through Sandbox analysis.
Executed containment actions including sender/domain blocking, URL blocking, mailbox remediation, and escalation to Microsoft for review.
Applied user protection measures such as forced password resets & sign-out from everywhere and MFA validation.
Additional, Cloned or impersonating website mimicking the organization's website & domain is detected follow the above same investigative and mitigation workflows.
User Remediation & Incident Containment
Provided remediation guidance to impacted users, including full scans, browser cleanup, MFA review, extension validation, Inspected pop-up setting and password hygiene.
Reduced risk of persistence and repeat compromise through structured user recovery steps.
Post-Incident Identity & Mailbox Auditing
Reviewed Azure AD sign-in logs and audit logs to identify suspicious IP activity and abnormal authentication behavior.
Investigated mailbox and account changes including inbox rules, folder permissions, and user/application management actions.
Monitored SharePoint, OneDrive, and Microsoft Teams for unauthorized access or data manipulation.
Detected suspicious outbound email activity, including bulk or anomalous message sending.
Cloud Infrastructure Alerts
AWS: Analyzed GuardDuty and CloudTrail logs to validate security events and determine the nature of triggered alerts and validate user authorization.
Azure AD: Investigated sign-in anomalies, device code abuse, MFA alerts, and audit log irregularities.
Microsoft Defender for Cloud: Reviewed & investigate alerts related to:
- Role assignment changes.
- VM, server and database creation/deletion.
- Network & virtual security rules creation.
- Network and firewall rule creation/deletion.
- Load balancer, storage account creation.
- SQL Injection attempts and other defender for cloud alerts ...
Network Security (Meraki)
Monitored inbound and outbound traffic from corporate devices.
Blocked unauthorized devices and investigated traffic anomalies indicating potential compromise or data exfiltration.
Threat Detection Analysis (Taegis)
Conducted end-to-end alert analysis using both normalized and raw log data.
Used advanced queries to correlate events and support deeper threat investigations.
- Investigated and analyzed threats using process trees & timelines to identify root causes.
- Took appropriate action on corporate endpoints or provided clear, step-by-step guidance to users to identify, contain, and remediate malware present on affected machines.
Endpoint Security & Device Management (Intune)
Validated device ownership and enrollment status.
Assessed endpoint security posture including malware status, BitLocker encryption, Secure Boot, and code integrity.
Took corrective actions on lost, stolen, or compromised devices.
Takedown & Fraud Response
Coordinated takedown efforts for phishing emails & domains, fraudulent websites, social media impersonation, and recruitment fraud.
Collaborated with Digital Security, Social Media, and HR teams for timely incident resolution.
Credential Theft Response
Responded to credential exposure incidents by notifying users and application, enforcing password resets, and providing account-security guidance.
Supported users in securing corporate accounts and monitoring for misuse.
Thread Hunt
Learning ....
Skills: Cybersecurity, Vulnerabilities, Threat intelligence, Incidence response
