Ajay Kumar Balam

About Ajay Kumar Balam

A competent professional 5+ years of experience in information security, • Across one or more of the following: Security Analysis, Security Monitoring, Security Incident Management and Incident Response. • Have Hands on experience on Qradar, Splunk and ArcSight tool. • SIEM (Security Information and Event Management) tools like Monitoring real-time events and analysis Security Monitoring and Operation using Qradar, ArcSight. • Using various security tools to perform monitoring and analysis of security events to detect security risks and threats within established customer Service Level Agreements. • Recognize successful cyber intrusions and compromises through log review and analysis of relevant event detail information. • Create formal incidents and support the investigation of such incidents to not only mitigate the current threat but also prevent future occurrences. • Support escalation and work closely with stakeholders as required. • Document all actions taken during incident investigations. • Work closely with other teams to support the incident management process. • Provide tuning and filtering recommendations to engineering teams. • Support requests for data by the customer and/or other teams. • Assist with the identification, creation and refinement of the team processes and procedures. • Stay abreast of current threats and vulnerabilities, particularly those that may directly impact the Environment • Have knowledge in device integration, alarm creation and watch list and Active channel creation in ESM.

Experience

1. Information Security Analyst

   Accenture

   Jun 2021 — Present

   Working in Security Operation Centre (24x7), monitoring of SOC events, detecting and preventing the Intrusion attempts.\\\\n• Monitoring, analysing real-time events using SEIM tools and responding to infrastructure threats and vulnerabilities.\\\\n• Collecting the logs of all the network devices and analyse the logs to find the suspicious activities.\\\\n• Monitoring the DLP and Email and web logs and Global NIS Mails, Malware, Spam mails & investigate and escalating to the L2 and closing the incidents.\\\\n• Responding to various security alerts for various client and scanning for vulnerabilities using tools like Nexpose.\\\\n• Differentiate the false positives from true intrusion attempts and help remediate / prevent.\\\\n• Support escalation and work closely with stakeholders as required.\\\\n• Research, analysis, and response for alerts; including log retrieval and documentation\\\\n• Conduct analysis of network traffic and host activity across a wide array of technologies and platforms\\\\n• Assist in incident response activities such as host triage and retrieval, malware analysis, remote system analysis, end-user interviews, and remediation efforts\\\\n• Recognize cyber-attacks based on their signatures. Differentiate the false positives from true intrusion attempts and help remediate/prevent cyber attacks\\\\n• Compile detailed investigation and analysis reports for internal CSOC consumption and delivery to management\\\\n• Analyse network traffic, IDS/IPS/DLP events, packet capture, and FW logs\\\\n• Analyse malicious campaigns and evaluate effectiveness of security technologies\\\\n• Develop advanced queries and alerts to detect adversary actions\\\\n• Lead response and investigation efforts into advanced/targeted attacks\\\\n• Provide expert analytic investigative support of large scale and complex security incidents\\\\n• Direct prior experience with core security technologies (SIEM, firewalls, IDS/IPS, HIPS, proxies, vulnerability scanners, AV, etc.)\\\\n \\\\n\\\\n \\\\n \\\\n\\\\n \\\\n