Ankush Sharma

About Ankush Sharma

Total of 11+ years of experience in Information Security domain.Experience in multiple EDR product like Fireye CrowdStrike,Microsoft defender for proactively hunting suspicious events based on MITRE defined TTP\'sStrong knowledge in malware analysis and also the ability to conduct detailed analysis of various security related events like social engineering attacks, malware outbreak, DDoS, ransomware,AITM and other so on.Experience in analyzing logs generated by both endpoints and network devices using Splunk Enterprise Security,Arcsight,Crowstrike,Sentinel,Cortex XSIAM. Creating correlation rules and fine-tuning false positives for effective SOC monitoring.[Firewalls/IDS/IPS/DNS/Bluecoat Proxy/Antivirus logs]Hunting TTP\'s of APT groups and mapping them with the MITRE ATT & CK framework. Performing gap analysis for the identified tactics followed by creation of detection logics.Lead a team of security analysts, overseeing alert volumes, query quality, and performance metrics.Conduct monthly review calls with team members to ensure continuous improvement and accountability.Manage client SLAs and handle high-priority tickets and customer requests with precision.Perform proactive threat hunting and incident investigations using advanced techniques.Utilize Palo Alto XSIAM,Sentinel for threat detection, response, and automation.Deliver technical training sessions to upskill the team and foster knowledge sharing.Create SOPs for new CSIRT processes and communicate updates to stakeholders.Document best practices and standardize operational procedures across the team.Identify and implement automation opportunities to enhance incident response efficiency.Hire and onboard high-quality engineers, ensuring team growth and capability.Ensure comprehensive training for all team members on technical and customer service aspects.Review work output and provide coaching and mentoring to improve performance.Lead weekly and monthly customer calls to maintain strong client relationships and service quality.Administration experience on SIEM tools HP Arcsight,Splunk,Microsft Sentinel,Cortex XSOAR: Analyst Fine tuning of the rules and making use cases.Handled Security Incidents. Performed analysis of incidentsWorked on EDR products Carbon Black,Fireeye,MDATP.Monitored threats using Symantec, Websense, FireEye Tipping Point IPS,CheckPoint Firewall.Creating threat cases and reports for newly added log sources.

Experience

1. Senior Incident Responder

   Microsoft

   Jan 2026 — Present

Education

• CBSE Board

  X Standard

  2007 — 2009

• University of Jammu

  XII Standard, Kv Nagrota

  2009 — 2013

• MIET Jammu university

  Bachelor of Engineering (BE), CSE

  2009 — 2013

• KV Nagrota

  Higher secondary, non medical

  2007 — 2009

Skills

• Html
• Dns
• Active Directory
• Windows Server
• Information Security
• Dhcp
• Kali Linux
• Nessus
• Windows
• Edirectory
• Siem
• Metasploit
• Nmap
• Vulnerability Assessment
• Arcsight