Harsh Kumar Gupta

SOC Analyst at Subha Technical Services Pvt. Ltd. (2025-06 – Present)

• Installed, configured, and managed ArcSight ESM, Logger, and SmartConnectors, enabling centralized log collection from Windows (Security, System, Sysmon), Active Directory, Microsoft Exchange, Firewall, and Kaspersky AV.
• Automated enterprise-wide Sysmon deployment and configured Advanced Audit Policies via Group Policy to enhance endpoint telemetry and logging coverage.
• Developed and fine-tuned correlation rules mapped to the MITRE ATT&CK framework to detect unauthorized and anomalous activities.
• Performed incident triage and escalation, preparing SOC reports, RCA documentation, and actionable recommendations to improve detection coverage.
• Managed and configured RSA NetWitness components including SA, VLC, Decoder, Concentrator, Broker, ESA, and Archiver across VMware ESXi and Hyper-V infrastructure.
• Deployed and configured Sysmon across Windows endpoints using AD GPO, Scheduled Tasks, and batch scripts, and configured WinRM for centralized collection of Security and Sysmon logs in RSA NetWitness.
• Engineered web and application log ingestion using NXLog, developing CEF-based configurations for IIS, SharePoint, Tomcat, Nginx, and Apache, forwarding logs to NetWitness VLC via Syslog, and automated service-specific NXLog configuration deployment using batch scripts and a centralized base nxlog.conf template.
• Created and configured CEF parsers on NetWitness Log Decoder to parse incoming logs and map events to the required SIEM metadata.
• Configured Microsoft SQL Server and Oracle DB auditing to generate audit events through Windows Event Logs for centralized SIEM collection and monitoring.
• Implemented centralized Syslog log collection (Severity 6 – Informational) across firewalls, L2/L3 switches, and routers, forwarding security, authentication, configuration, and operational events to RSA NetWitness VLC for centralized security monitoring and analysis.
• Monitored and secured 28000+ endpoints using EDR solutions, identifying and responding to potential threats.
• Leveraged threat intelligence platforms such as MISP, VirusTotal, AlienVault OTX, and VX-Underground to identify IOCs and threat detection and blocking.
• Developed and tuned correlation rules and alerts, performing alert triage, in-depth log analysis, and root cause analysis (RCA) to investigate security incidents.

Intern - Engineering Developer at QO-BOX Pvt. Ltd. (2024-07 – 2024-10)

• Successfully completed a 3-month Engineering Developer internship.
• Developed and debugged web applications while identifying and resolving application-level issues to improve system performance, stability, and code quality.
• Worked with Python, Django, MySQL, and REST APIs to build backend solutions, gaining hands-on experience with modern tools and Agile development practices.

Bachelor of Technology (B.Tech) in Computer Science and Engineering – Dr A.P.J Abdul Kalam Technical University, Lucknow (2022 – 2025)

Diploma in Computer Science and Engineering – Government Polytechnic Mau (2019 – 2022)