Kaif Ahmed Mohmad

• Monitored security alerts and events using SIEM tools like Splunk and QRadar, performing in-depth analysis and ensuring timely incident response. • Conducted vulnerability assessments using Nessus and Qualys, identifying and mitigating risks in critical systems and applications. • Performed root cause analysis for security incidents and created detailed reports to improve security posture and reduce recurring threats. • Designed and enforced security policies aligned with NIST and ISO 27001 frameworks, ensuring compliance with regulatory and organizational standards. • Developed and executed security awareness programs, including phishing simulations, to enhance staff preparedness and reduce incidents. • Investigated suspicious activities using tools like Virus Total, Wireshark, and Nmap, correlating data to identify and address potential threats. • Collaborated with IT teams to implement advanced threat detection mechanisms and maintain a secure application lifecycle. • Automated security tasks using PowerShell and Beanshell, improving efficiency in enforcing security policies across AWS and Azure environments & Created incident playbooks and disaster recovery plans to ensure prompt action during security events and minimize downtime

• Monitored and analyzed security events across SIEM and EDR, identifying anomalies, policy violations, malware indicators, and potential intrusions • Performed L1–L2 triage, including severity classification, correlation across multiple log sources, enrichment with threat intelligence, and deep-dive analysis of suspicious events. Investigated alerts from firewalls, IDS/IPS, servers, and endpoint logs to detect malware activity, unauthorized access attempts, and lateral movement • Executed containment actions during active incidents (account lockouts, host isolation, blocking malicious IPs/domains) following IR playbooks and escalated complex cases to L3/Engineering • Conducted full lifecycle analysis of security events—triage, scoping, containment, and RCA—producing actionable recommendations that directly reduced recurring alerts and operational noise • Integrated and validated threat intelligence feeds (MISP, OTX, FS-ISAC) to enhance correlation rules and improve detection of emerging threat • Maintained incident documentation, case notes, and compliance evidence for audits, ensuring accuracy, completeness and demonstrating strong verbal and written communication skills. • Contributed to updating SOC playbooks, tuning detection rules, improving log parsing workflows, and maintaining SIEM data quality to strengthen overall security posture

• Delivered L1/L2 support by resolving complex issues related to Windows OS, login/authentication, software failures, email, printing, and network connectivity, consistently achieving high first-call resolution rates • Managed high-volume ticket queues using ITSM tools, ensuring issues were categorized, prioritized, and resolved within agreed SLA targets • Handled multiple tickets simultaneously, prioritizing based on urgency and impact to minimize downtime and disruption to business operations and performed advanced troubleshooting for hardware, software, and application-related issues using structured diagnostic methods to quickly identify and resolve problems • Analyzed root causes, tested solutions, and implemented permanent fixes for recurring issues, significantly reducing repeat incidents and improving overall system reliability and proactively identified incident trends, reviewed ticket data to identify patterns, and implemented fixes to address system weaknesses • Provided remote support and on-site assistance to resolve issues quickly, ensuring users returned to work with minimal disruption