Noor Malhotra

Results-driven SOC Analyst with 6+ years of experience in security operations, incident response, and threat detection across banking, insurance, telecom, and enterprise environments. Hands-on expertise in SIEM (Splunk, QRadar, Microsoft Sentinel), EDR/XDR, IDS/IPS, and SOAR automation, with proven experience handling L1–L3 incidents including malware, phishing, ransomware, and insider threats. Strong background in threat hunting, log analysis, vulnerability management, and incident response playbooks, aligned with MITRE ATT&CK, NIST, ISO 27001, and ITIL frameworks.

Recognized for improving SOC efficiency, reducing MTTR, and strengthening organizational security posture.

Certified

CompTIA Security+, ISC2 CC, and Certified SOC Analyst (C|SA).

SOC Analyst - Packetlabs - Toronto

(2024-03 - 2025-12)

• Monitored, analyzed, and investigated security alerts from SIEM platforms (Splunk / QRadar / Sentinel) to detect potential threats, intrusions, and anomalous activities.
• Performed Level 2 incident analysis including triage, correlation, escalation, and root cause identification for malware, phishing, ransomware, brute-force, and insider threat incidents.
• Led incident response activities following NIST and MITRE ATT&CK frameworks, including containment, eradication, recovery, and post-incident reporting.
• Conducted log analysis across network devices, firewalls, IDS/IPS, endpoints, servers, and cloud environments to identify Indicators of Compromise (IOCs).
• Investigated and responded to phishing campaigns, malicious email attachments, and social engineering attacks using email security gateways and sandboxing tools.
• Utilized EDR/XDR tools (CrowdStrike, Defender for Endpoint, SentinelOne) to analyze endpoint behavior and respond to threats in real time.
• Created, updated, and tuned SIEM detection rules, alerts, and correlation searches to reduce false positives and improve threat detection accuracy.
• Performed threat hunting activities using threat intelligence feeds, behavioral analytics, and MITRE TTP mapping.
• Supported vulnerability management by validating scan results, prioritizing risks, and coordinating remediation with infrastructure and application teams.
• Documented incidents, response actions, and lessons learned in incident tickets and SOC playbooks to improve future response effectiveness.
• Collaborated with network, cloud, and IT operations teams to remediate security gaps and strengthen defensive controls.
• Assisted in compliance and audit support activities aligned with ISO 27001, SOC 2, PCI-DSS, and internal security policies.
• Participated in 24x7 SOC operations, shift handovers, and on-call rotations while meeting SLAs and KPIs.
• Mentored junior SOC analysts and contributed to SOC process improvements and automation initiatives

Junior Cyber Security Analyst - Vumetric

(2022-02 - 2024-02)

• Monitored security events and alerts using SIEM platforms to identify potential threats, suspicious activities, and policy violations across enterprise environments.
• Performed initial triage and analysis (L1/L2) of security incidents including phishing, malware, brute-force attempts, and unauthorized access attempts.
• Investigated security alerts and logs from firewalls, IDS/IPS, servers, endpoints, and cloud services to determine severity and impact.
• Escalated confirmed incidents to senior analysts and incident response teams with detailed findings, timelines, and recommended actions.
• Supported incident response activities by assisting in containment, evidence collection, and remediation tracking following NIST guidelines.
• Conducted phishing analysis by reviewing email headers, URLs, and attachments and assisted in user awareness and response actions.
• Assisted with endpoint security monitoring using EDR tools to identify abnormal behavior and potential compromises.
• Maintained accurate incident documentation in ticketing systems such as ServiceNow or Jira to support audits and post-incident reviews.
• Supported vulnerability management by reviewing scan outputs, validating findings, and coordinating remediation with IT teams.
• Followed SOC runbooks and playbooks to ensure consistent response and adherence to security policies and SLAs.
• Assisted in updating security dashboards, reports, and metrics for management and compliance reporting.
• Participated in 24x7 SOC operations, shift handovers, and knowledge-sharing sessions with team members.
• Stayed current with emerging threats, attack vectors, and security best practices through threat intelligence feeds and continuous learning.

Operations Manager Wireless - Fido - Toronto, Ontario

(2019-06 - 2022-01)

• Led end-to-end wireless operations supporting mobile voice, data, roaming, and value-added services across retail and digital channels.
• Managed day-to-day operational performance for wireless services, ensuring high availability, network stability, and adherence to SLAs.
• Oversaw incident, problem, and escalation management for wireless service outages, degradation, and customer-impacting issues.
• Coordinated with Network Operations Center (NOC), IT, vendors, and field teams to resolve LTE/5G, provisioning, and service activation issues.
• Monitored and analyzed KPIs and operational dashboards (service availability, MTTR, ticket volumes, churn drivers) to drive continuous improvement.
• Implemented process improvements to reduce service disruptions, improve first-call resolution, and enhance customer experience.
• Supported wireless provisioning, SIM activation, number portability (MNP), and device lifecycle operations.
• Ensured compliance with CRTC regulations, internal telecom policies, and data privacy standards.
• Managed vendor and partner operations, including escalations, performance reviews, and SLA adherence.
• Led, coached, and performance-managed operations teams, including scheduling, workload planning, and skills development.
• Partnered with customer care, retail operations, and product teams to resolve systemic issues impacting customer satisfaction.
• Produced executive reports and operational insights for leadership, highlighting risks, trends, and improvement initiatives.
• Supported network launches, upgrades, and change initiatives (LTE/5G enhancements, device rollouts, billing or provisioning changes).
• Drove cost optimization and efficiency initiatives while maintaining service quality and operational excellence.

Bachelor of Arts - Law and Society - York University

Cybersecurity Boot Camp - Cybersecurity - University of Toronto/EDX