Adarsh Balamkar

SOC Analyst with 6+ years of experience in 24x7 Security Operations Centers covering security monitoring, incident response, malware analysis, threat intelligence, and threat hunting.

Microsoft Certified Security Operations

Analyst (SC-200). Skilled in investigating incidents across network, endpoint, cloud, and email environments using Splunk Enterprise Security, Microsoft Sentinel, Microsoft Defender for Endpoint, and CrowdStrike Falcon. Experienced in KQL threat hunting, detection engineering, phishing analysis, root cause analysis (RCA), MITRE ATT&CK, Cyber Kill Chain, and OWASP Top 10 web application security.

IT Analyst - TCS.

(2025-08)

• Monitor security events in a 24x7 SOC to detect, investigate, and prevent intrusion attempts.
• Configure and fine-tune Microsoft Sentinel analytics rules for real-time threat detection and log correlation.
• Investigate Microsoft Defender for Endpoint alerts, perform root cause analysis, and escalate incidents based on severity.
• Conduct proactive threat hunting using Microsoft Sentinel KQL queries and query-based detections.
• Monitor and respond to Advanced Persistent Threats (APT) using Microsoft security tooling.
• Analyze Microsoft Defender for Cloud recommendations and work with infrastructure teams to drive remediation.
• Use Microsoft Purview for DLP and compliance monitoring to support regulatory adherence.
• Map detections and incident findings to MITRE ATT&CK techniques to improve coverage and reporting.
• Perform incident containment actions such as isolating endpoints, blocking malicious IPs and domains, and disabling compromised accounts.
• Reduce false positives by tuning detection rules and refining alert thresholds.
• Document incidents, investigation steps, and lessons learned in clear incident reports for stakeholders.
• Collaborate with L1 analysts, L3 teams, and client stakeholders to guide escalations and shift handovers.

Senior SOC Analyst - Trellix India.

(2024-06 - 2025-08)

• Managed support cases from creation through closure while prioritizing high-severity cases.
• Delivered Tier-2/3 technical support for enterprise Trellix security products including ePolicy Orchestrator (ePO), Endpoint Security (ENS), Data Loss Prevention (DLP), and Web Control.
• Diagnosed and resolved complex configuration defects, upgrade failures, policy conflicts, and performance degradation issues.
• Conducted deep root cause analysis by replicating client issues in isolated lab environments, analyzing system/application logs, and collaborating with Engineering & Escalation teams.
• Managed high-priority support cases end-to-end within strict SLA targets via email, phone, and remote assistance sessions.
• Authored internal Knowledge Base (KB) articles and troubleshooting guides to optimize team knowledge management and operational efficiency.
• Supported disaster recovery initiatives, policy optimization, and security recommendations in alignment with customer data privacy standards.
• Ensured compliance with data protection policies during troubleshooting processes.

Security Analyst - Concentrix Pvt. Ltd.

(2021-05 - 2023-02)

• Identify suspicious/malicious activities in Carbon Black EDR and 365 defender for endpoints.
• Monitoring and performing in-depth analysis of security alerts using the Carbon Black platform.
• Continuously monitoring and interpreting threats using the IDS and SIEM tools.
• Monitored security events and logs, including proxy logs, IPS/IDS events, firewall, Active Directory (user verification), vulnerability scans, anti-malware events, endpoint security, web application firewall, NetFlow, and packet capture.
• Investigated malicious phishing emails, domains, and IPs using open-source tools, recommending appropriate blocking measures based on analysis
• Analyzed domain and email security to identify potential risks and participated in phishing campaigns, searching firewall, email, web, and DNS logs to mitigate intrusion attempts.
• Perform Malware Analysis by Static and Dynamic methods to identify the malicious IOCs-indicator of compromise, taking action around IOCs identified.
• Identify and investigate indicators of compromise (IOCs), e.g. malicious IPs/URLs, e.g., into network tools/applications Stay up to date with current vulnerabilities, attacks.
• Resolved issues impacting SIEM dashboard functionality to enable accurate report generation.
• Well versed with Networking Concepts, Protocols and System Security which helps in understanding Network/traffic flow of environment.

Security Analyst - Foiwe Info Global Solutions.

(2019-02 - 2021-04)

• Performed website anti-malware and defacement monitoring with real-time alerting on detected anomalies.
• Monitored OWASP Top 10 risks including broken authentication, sensitive data exposure, broken access control, XSS, vulnerable components, and insufficient logging.
• Built reports and dashboards and tuned detection rules to improve alert quality.
• Troubleshot SIEM dashboard issues, including failed report generation and dropped data feeds.
• Investigated phishing, spoofing, spam, and malware-based email threats.
• Managed email security controls, including SPF, DKIM, DMARC, and secure email gateway policies.
• Performed email header analysis, IOC validation, and threat triage for security incidents.
• Supported incident response activities and coordinated remediation with cross-functional teams.
• Generated security reports and recommended improvements to strengthen email protection and compliance.

Master of Computer Applications MCA - Visvesvaraya Technological University (VTU) (2018)