Faizan Ammar

● Led the Information Security Incident Response Team, overseeing all aspects of incident response activities, including detection, analysis, containment, eradication, and recovery. ● Developed and implemented incident response policies, procedures, and playbooks to streamline response efforts and ensure adherence to best practices. ● Established and maintained relationships with internal and external stakeholders, including IT teams, legal counsel, law enforcement agencies, and third-party vendors. ● Managed and coordinated incident response exercises and simulations to test the effectiveness of response plans and enhance team readiness. ● Conducted post-incident reviews and analysis to identify root causes, lessons learned, and opportunities for improvement. ● Conduct vulnerability assessments and apply patches and updates to systems and applications to address security vulnerabilities. ● Implement and maintain antivirus and antimalware solutions across the organization's network and endpoints. ● Monitor for indicators of compromise (IOCs) and investigate potential malware infections. ● Develop and execute strategies to contain and eradicate malware threats effectively. ● Oversee the deployment and management of Endpoint Detection and Response (EDR) technology. ● Develop and maintain incident response plans and procedures tailored to various types of security incidents. ● Lead the response to security incidents, including containment, investigation, and recovery efforts. ● Document security incidents, root cause analysis, and remediation actions taken for regulatory compliance and organizational learning purposes. ● Collaborate with internal teams and external stakeholders, including legal and regulatory bodies, during security incident response activities. ● Design, develop, engineer, and implement solutions meeting security requirements, responsible for the integration and implementation of computer system security solutions.

●Implemented and managed Microsoft Sentinel for security event monitoring, detection, and response. ●Utilized Microsoft Defender XDR for endpoint threat detection, investigation, and remediation. ●Developed and maintained security playbooks and automated response actions in Microsoft Sentinel using Azure Logic Apps. ●Led successful implementation of Microsoft Azure Sentinel SIEM from the scratch for effective security monitoring. ●Conducted threat hunting activities to proactively identify security threats and vulnerabilities. ●Collaborated with cross-functional teams to improve security posture and mitigate security risks. ●Played a key role in the Incident Response Team , conducting triage, analysis, and response to cybersecurity incidents, including malware outbreaks, data breaches, and insider threats. ● Developed and maintained incident response tools and systems to support the detection, analysis, and mitigation of security incidents. ● Participated in tabletop exercises and incident response drills to test and validate response plans and procedures. ● Contributed to the development of incident response playbooks and standard operating procedures (SOPs). ● Designed, implemented, and managed security controls and configurations for AWS cloud environments. ● Conducted security assessments and audits to identify vulnerabilities and compliance gaps. ● Developed and maintained security policies, procedures, and best practices for AWS infrastructure. ● Implemented and managed AWS security services, including AWS Identity and Access Management (IAM), AWS Key Management Service (KMS), and AWS WAF. ● Configured and monitored AWS CloudTrail and AWS Config for logging, monitoring, and compliance purposes. ● Conducted security incident response and forensic investigations in AWS environments. ● Provided security guidance and support to development and operations teams for secure cloud deployments.

Manage, implement and monitor a strategic, comprehensive corporate information security monitoring and operation program to ensure the integrity, confidentiality and availability of information owned, controlled or processed by the organization. ● Provide real time decision making for ongoing information security incidents as they occur to protect corporate assets. ● Analyzes incident request trends and patterns to improve processes and services. ● Oversee all Global Security Operations Center positions in their daily tasks and projects. ● Participate in the selection of technology, devices and software that are to be used on the network and in the information security infrastructure, and ensure that their implementation meets information security requirements. ● Participate in incident response activities as a senior information security representative as needed. Act as the senior information security liaison to the IT Infrastructure teams. ● Develop and report on metrics showing how the network and the information security infrastructure are being managed with respect to information security. ● Provides direction to subordinates based on general policies and management guidance. Interprets and executes policies and procedures to respond to incident requests and provide desk side analysis of systems.

Extensive experience in securing AWS Workloads. ● Hands-on experience of working with AWS Security Services like AWS Shield,AWS GuardDuty,AWS Macie, AWS Inspector and AWS Security HUB. ● Experience of designing Multi-tier Applications using AWS well documented architecture. ● Extensive experience of AWS IAM Identities and Virtual Firewall(Security Groups) and NACLs. ● Experience of implementing Least Privileged Access on AWS using Managed Policies for AWS Storages like S3. ● Creating (and revising as needed) an overall Information Security Policy PureVPN, and all necessary supporting policies from product development lifecycle perspective. ● Assessing and classifying all information assets and documentation. ● Implementing (and revising as needed) a set of security controls. ● Monitoring and managing all security breaches and major security incidents.Analyzing, reporting, and reducing the volume and impact of severity breaches and incidents. ● Scheduling and completing security reviews, audits, and penetration tests. ● Make sure all critical and major security incidents are addressed within SLA and OLA response and send out the critical alerts for such incidents. ● Revamping of the SIEM infrastructure (Mcafee ESM). ● Mentoring Team responsible for the implementation of HOST Based DLP Solution. ● Perform feature set assessment of popular UTM Appliances and NGFWs (CISCO FTD,Hillstone, Fortinet and Huawei). ● Helps out security analysts in SIEM correlation rule tuning and Use-Case design. ● Configured Medium Interaction Honeypot using HoneyBot for the detection of malicious activity on the network. ● Performed Security Architecture reviews of AWS with respect to AWS Security Best Practices related to IAM,EC2,VPC and S3 services. ● Improving incident management and response strategy by Implementing Cyber Kill-chain.

Provide technical and operational leadership for cyber-security incident response. ● Performed sizing and planning the deployment of Mcafee ESM and IBM Qradar SIEM Solutions. ● Assist with triage, prioritization and response to cyber-security events and incidents using IBM QRadar and McAfee ESM. ● Developing and writing Log Parsers for custom applications,Log/Data Sources in QRadar and McAfee ESM. ● Act as technical incident lead during major cyber-security incidents ● Continuously improve maturity and operational efficiency of Mcafee ESM/IBM QRadar SIEM Solution – including methodologies, processes, detection use cases and response playbooks. ● Oversee completion of day-to-day checklist(s), including: log review, management report scheduling & running, alert analysis, and escalation follow up activity status. ● Provide oversight and guidance to junior analysts and fulfill SOC manager responsibilities in the absence of the SOC Lead. ● Maintain an up-to-date knowledge of cyber threats ● Drive continuous learning and knowledge sharing within the team. ● Worked in a 'business hours + rostered on-call' environment. ● Assist the Cyber Security Lead with the development of the IA related Procedures, and Work Instructions. ● Develop, improve and help implement best practices for risk reduction across a broad range of enterprise applications, systems, networks and interfaces.

-Managed and maintained Windows Server infrastructure, including Active Directory, DNS, DHCP, and Group Policy. -Installed, configured, and updated Windows servers and applications to ensure reliability and security. -Monitored system performance and implemented optimizations to improve efficiency and scalability. -Conducted regular backups and disaster recovery planning to ensure data integrity and availability. -Resolved technical issues and provided technical support to end-users and other IT teams. -Implemented security measures and best practices to protect against cyber threats and vulnerabilities. -Documented system configurations, procedures, and troubleshooting steps for knowledge sharing and reference. -Administered and supported Windows-based desktops, laptops, and servers in a multi-site environment. -Deployed and managed software updates, patches, and antivirus solutions to mitigate security risks. -Configured and maintained Microsoft Exchange Server for email services and collaboration tools. -Managed user accounts, permissions, and access controls in Active Directory and file systems. -Implemented and maintained virtualization technologies such as Hyper-V for server consolidation and resource optimization. -Provided technical training and guidance to end-users on system usage and best practices.

-Managed and maintained Linux server infrastructure, including installation, configuration, and maintenance of servers running various distributions such as CentOS, Ubuntu, and Red Hat. -Implemented and maintained system security measures, including firewalls, access controls, and intrusion detection/prevention systems, to protect against cyber threats and vulnerabilities. -Automated routine administrative tasks using scripting languages such as Bash and Python, improving efficiency and reducing manual errors. -Monitored system performance and conducted performance tuning and optimization to ensure maximum uptime and resource utilization. -Provided technical support and troubleshooting for Linux-based systems, resolving issues promptly to minimize downtime and disruptions. -Conducted regular backups and disaster recovery planning to ensure data integrity and availability in the event of system failures or disasters. -Documented system configurations, procedures, and best practices for knowledge sharing and reference. -Installed, configured, and maintained Linux-based servers and services, including web servers (Apache, Nginx), database servers (MySQL, PostgreSQL), and email servers (Postfix, Sendmail). -Managed user accounts, permissions, and access controls using tools such as LDAP and SSH. -Deployed and managed virtualization technologies such as KVM and VMware for server consolidation and resource optimization. -Implemented and managed monitoring solutions such as Nagios, Zabbix, or Prometheus to ensure the health and performance of Linux systems. -Conducted system hardening and security audits to identify and remediate security vulnerabilities. -Collaborated with cross-functional teams to plan and execute system upgrades, migrations, and expansions.