Avinash Tambale

About Avinash Tambale

Results-driven SOC Analyst with 3+ years of experience in monitoring, detecting, and responding to security incidents across enterprise. Strong hands-on expertise in Splunk ES and Azure sentinel SIEM, SentinelOne EDR, Microsoft Defender for Endpoint, and XDR platforms.Experienced in investigating phishing, malware, C2 communications, persistence, lateral movement, and advanced threats using MITRE ATT & CK framework. Proven ability to analyze Windows, network, and endpoint alerts and deliver effective incident remediation.

Experience

1. Soc Analyst

   Hexaware Technologies

   Nov 2022 — Present · Mumbai, IN

   Monitored and analyzed security events using Splunk ES SIEM, ensuring 24x7 SOC operations.•Investigated and responded to endpoint alerts generated by Microsoft Defender for Endpoint.•Investigated and responded to endpoint security threats using SentinelOne EDR and XDR,including malware, ransomware, and suspicious behavior alerts.•Conducted email threat investigations using Microsoft Defender for Office 365, handling phishing, spear-phishing, and Business Email Compromise (BEC) cases.•Performed in-depth investigations of lateral movement and persistence techniques using Microsoft Defender for Endpoint.•Analyzed and correlated firewall, IDS/IPS, and proxy logs to identify malicious activity and prevent security breaches.•Investigated C2C (Command-and-Control) traffic and malware-related alerts to mitigate data exfiltration risks.•Detected anomalous traffic patterns indicative of DDoS attacks, phishing campaigns, bruteforce attempts, and data exfiltration.•Investigated failed login attempts, suspicious administrative activities, and privilege escalation attempts across Windows and Linux environments.•Performed comprehensive alert analysis to classify events as false positives, security events,or confirmed incidents.•Quarantined and analyzed malicious emails, extracting Indicators of Compromise (IOCs) for threat intelligence enrichment.•Participated in incident response activities, including containment, eradication, and recovery in coordination with IR teams.•Managed incidents end-to-end using ServiceNow (SNOW), ensuring accurate documentation and SLA compliance.•Conducted vulnerability assessments using Nessus, prioritizing remediation based on risk,severity, and business impact.•Utilized OSINT platforms such as VirusTotal, Any.Run, and MX Toolbox to enrich threat intelligence and support investigations.•Collaborated with cross-functional teams to remediate vulnerabilities and strength enendpoint and network security posture.

Education

• Sambhram Institute of Technology

  Bachelor's of Engineering