Franklin Gabila

Incident Response Analyst @Ventech Solutions

Servers, Windows Servers, System Application, Databases, Web Servers, and Networking Devices• Investigated phishing alerts up until containment and eradication.• Leveraged analysis with the MITRE attack framework for confirmed incidents.• Working knowledge of security platforms and tools, such as firewall, CASB, proxy, SIEM, and SOAR• Monitored the health of security devices and syslog instances and responded to anomalies as defined in the SOP.• Performed email-based investigation and successfully contained phishing emails and potential email account takeovers.• Performed threat intelligence including open-source investigations to identify current attacks that may target the client’s industry.• Provided support in identifying malicious network activity, threats impacting network operations and developing appropriate countermeasures, eliminating network threats and vulnerabilities.• Investigated alerts and performed searches on Splunk SIEM• Responded to computer security incidents by collecting, analyzing, preserving digital evidence, and ensuring that incidents are recorded and tracked in accordance with organizational SOC requirements.• Used McAfee DLP to protect intellectual property and ensure compliance by safeguarding sensitive data.• Analyzed email logs to confirm malicious emails were not delivered or were quarantined and malicious attachments dropped.• Worked with SOC Engineers and other SMEs to operate Intrusion detection and prevention systems (IDS/IPS) such as SNORT and Sourcefire to analyze, detect worms and vulnerability exploit attempts.• Staying up to date with current vulnerabilities, attacks, and countermeasures• Analyzed Threat Patterns on various security devices and validation of false/true positive security incidents.• Performed investigations relating to potential compromise and worked with the IR team to determine impact and eradication.