Loh Soma

Experience

1. Cyber Security Analyst

   Ewinns Llc

   Jan 2023 — Present · VA, US

   I monitored network and security traffic for potential security threats, triaged incidents andalerts, and assigned tickets to analysts. Triage involved handling over alerts per day. Additionally, I contributed to incident response activities, actively participating in mitigatingsecurity incidents. Throughout this role, I investigated and successfully closed over 1500tickets per year. I conducted in-depth investigations into event logs ingested into SIEM Splunk, andeffectively responded to incidents using the XDR tool, specifically Microsoft Defender forEndpoint. Utilizing OSINT tools such as VirusTotal, any.run, Ipinfo and more I investigated URLs, domain names, malicious public IPs, malware files, and phishingemails. Furthermore, I examined quarantined emails, analyzing email headers, links, and domainnames. Subsequently, I reported and blocked malicious sender emails or domains. Ireported spam and phishing cases to Microsoft for further analysis and blocked the senderor domain involved. In an effort to enhance security, I took proactive measures by blockingor reporting malicious domains and IP addresses to be blocked in Microsoft 365 Defenderand at the firewall level. Collaboration with the security team was integral to my role, where we worked together toupdate and maintain security policies and procedures. I played a key role in maintaining theintegrity of the organization\'s security by resetting user passwords and deactivatingcompromised user accounts. Additionally, I conducted scans on compromised computers,removing malware to ensure a secure environment. A critical aspect of my responsibilities involved monitoring users, including executives\'devices and accounts, for alerts, incidents, and Indications of Compromise (IoC). I meticulously followed the organization\'s incident response process, which included thestages of preparation, detection and identification of incidents, containment and mitigation of