Raghawendra Naik

WORK HISTORY

EDUCATION

ABOUT RAGHAWENDRA NAIK

4+ years of Experience in security operations.*Manage 24x7 operations at SOC, including event monitoring which includes incident detection, tracking and analyzing on a real-time basis, with follow-up on any suspicious activity.*Investigation for different log sources (AV, Proxy, IPS, IDS, Firewall, WAF and Windows).*Skilled in log onboarding, implementation and parsing to ensure accurate correlation within SIEM*Working on fine-tuning of false-positive alerts in SIEM*Handle client requests and questions received via phone, e-mail, and internal ticketing portal swiftly with the detailed investigation to resolve information security incidents/alerts.*Have a basic knowledge on analyzing of suspicious file using Static and Dynamic techniques of Malware Analysis.*Some working knowledge in operating SIEM solutions like creating Dashboards and Reports.*Have exposed to various Usecases and co-relation Rules.Amazon Web Services :*24/7 Continuous Monitoring monitoring of AWS environments, including WAF, Lambda, GuardDuty, VPC, and RDS, to detect and respond to security threats.*Monitor web and network traffic using AWS CloudWatch and CloudTrail records to identify anomalies.*Track user activities across AWS services, including suspicious activities on web URLs, APIs, and load balancers, and report abnormalities to stakeholders.*Analyze logs from various AWS services (e.g, WAF logs, VPC Flow Logs, Lambda logs) to detect and investigate potential security incidents.*Continuously monitor the execution of Lambda functions for unusual activity or unauthorized access.*Continuously monitor GuardDuty findings and WAF alerts for potential security threats and malicious activity.*If any unusual IP activity appears unsafe, notify the appropriate stakeholders, and recommend blocking the attacker\'s IP.*Execute Log Insights hunts for top malicious/suspicious IPs across log groups.*Obtain and analyze top user agents for requests counted by specific rules to identify unusual behavior.*Using various kinds of threat intelligence technologies to identify the abnormal behavior by looking up the reputation of the rogue IPs.*Reporting all allowed, blocked, and unidentified IPs in AWS web traffic and to relevant stakeholders any notifications that are deemed suspicious while using the web-based application.*Updating all the suspicious IPs in consolidating spread sheet along with timeframe.*Identifying the changes on security groups along with IP ranges which is done by the end user.*Reports are shared with the relevant stakeholders on a weekly and monthly basis.