Dandre Morris

Security Operations Center Analyst @San Diego Gas & Electric

Triage all incoming security alerts on Splunk and team mailbox Monitor and escalate AWS GuardDuty and Azure Security Center alerts including extracting, validating, and recommended IOCs to content engineers Analyze phishing emails with Proofpoint (TAP, TRAP, POD) removing validated phishing campaigns from user inbox Escalate critical and high priority incidents to CSIRT. Support and assist in containment, remediation activities, and work with IT service owners on future prevention Analyze and hunt for security events for tuning and addition detection gaps and recommend to engineering compensating controls NERC and corporate requirements. Calibrate and add enhanced Splunk use cases for additional correlation detection that align to the MITRE ATT & CK framework Investigation and removal of malware infections on endpoints using Microsoft Defender and KQL Adding validated IoCs into CRITsBot and CloudFlare WAF for mitigation and prevention of current and future attacks