Abhiroop Bakshi

Security Operations Analyst and SOC Shift Lead with 2 years of hands-on experience in enterprise security operations and security assurance across 18 global enterprise clients in manufacturing, finance, and large-scale organizations. Proven track record in real-time threat analysis, end-to-end incident response, SIEM operations, risk analysis, and risk assessment using MITRE ATT&CK and NIST IR frameworks. Skilled in process optimization and automation of detection workflows, reducing MTTD from 28 to 16 minutes.

Adept at managing priorities across multiple tasks, delivering clear written and verbal security reporting to both technical and non-technical stakeholders.

Cyber Security Analyst — SOC Operations & Shift Lead - Tata Consultancy Services

(2024-01)

Managed Security Services | Enterprise SOC | 18 Global Clients (Manufacturing, Finance, Large Enterprises)

• Monitor and triage security alerts in real time across DNIF HyperCloud, HyperScale, and Microsoft Sentinel for 18 enterprise client environments, maintaining 99.99% monitoring availability across all accounts on 24x7 rotating shifts.
• Conduct structured threat analysis on every alert — classify severity, map to MITRE ATT&CK TTP, and determine true or false positive before executing response actions per SOC playbook.
• Enrich all IOCs (IP, URL, domain, file hash, email header) using VirusTotal, AbuseIPDB, URLScan.io, Shodan, and MXToolbox for reputation assessment and threat context confirmation.
• Write and execute DQL and KQL queries to fetch, filter, and correlate log data from firewalls, endpoints, proxies, and cloud sources during active incident investigations.
• Manage complete incident response lifecycle — detection, triage, containment, eradication, recovery, and ticket closure — following Confluence SOC playbooks and client-specific SOPs within defined SLA windows.
• Execute endpoint and network response actions: host isolation via SentinelOne / Microsoft Defender for Endpoint, IP/URL blocking, user account suspension, and firewall rule changes.
• Reduced Mean Time to Detect (MTTD) from 28 minutes to 16 minutes through systematic process optimization, SIEM use case refinement, and detection alert logic tuning — a 43% improvement in response efficiency.
• Lead automation initiatives including alert suppression rule development, DQL/KQL query template standardization, and workflow automation to reduce analyst noise and improve detection fidelity.
• Act as Shift Lead on every assigned shift, managing a team of 1–14 SOC analysts — distributing workload, resolving escalations, validating ticket closures, and ensuring SLA compliance across all 18 client queues.
• Review and quality-assure analyst-closed incidents before client-facing delivery; provide real-time coaching on ambiguous cases requiring advanced investigation judgment.
• Maintain incident tracker for all active, in-progress, and closed cases; prepare shift handover notes and operational documentation for incoming teams.
• Escalate critical incidents to L2/L3 engineers and client stakeholders with full context: affected assets, attack timeline, IOCs identified, actions taken, and recommended containment steps.
• Conduct security assessments on web application threats including SQL Injection, XSS, CSRF, and multi-layer DDoS attacks (L3/L4/L7), mapping findings to OWASP Top 10 and applying WAF rule recommendations.
• Perform packet-level inspection of HTTP/HTTPS traffic, DNS anomalies, and TCP/IP session behavior to extract actionable threat intelligence during live incident investigations.
• Author and deliver Weekly Security Reports (WSR) and Monthly Security Reports (MSR) to client stakeholders, covering incident summaries, threat trends, SLA metrics, and forward-looking security recommendations.
• Author post-incident analysis reports mapping attack sequences to MITRE ATT&CK techniques, with full IOC disclosure, attack timeline reconstruction, and tailored remediation guidance.
• Discovered and responsibly disclosed a critical authentication bypass vulnerability in Teachmint (timestamp-based), preventing potential exam fraud for thousands of students during COVID-19 remote assessments.

Bachelor of Technology - Computer Science Engineering - Shri Ram Institute of Technology (2019-01 - 2023-12)