Kanchan Dhore

Cyber Security professional with 3+ years of SOC experience at Cognizant, now advancing into Cyber Threat Intelligence. Proven track record in real-time threat monitoring, phishing analysis, malware investigation, IOC identification, and SIEM operations across ArcSight, Splunk, and IBM QRadar. Experienced in producing client-facing intelligence reports and managing security deliverables against SLAs.

Adept at translating technical findings into actionable recommendations for both technical and business stakeholders. Seeking to apply SOC depth and growing CTI expertise to deliver intelligence-led defense across the full threat intelligence lifecycle.

Security Analyst – Security Operations Centre (SOC) at Cognizant (2022-01 – Present)

• Conduct end-to-end threat investigations covering phishing campaigns, malicious domains, and threat infrastructure — identifying threat actors, mapping TTPs, and extracting actionable IOCs.
• Perform in-depth Phishing Email Analysis to uncover malicious indicators, attacker infrastructure, and campaign patterns; recommend and support containment and takedown actions.
• Carry out Malware Analysis to identify behavioral signatures, C2 communication patterns, and adversary techniques; map findings to MITRE ATT&CK for accurate threat classification.
• Monitor threat actor activities and emerging malware campaigns; maintain awareness of global and regional cyber threats relevant to client environments.
• Perform Log Analysis across network, OS, and database layers to identify anomalies, attack indicators, and lateral movement attempts.
• Recognize and document attack signatures; apply structured analytic techniques to assess threat scope and potential business impact.
• Monitor real-time security events using ArcSight ESM, ArcSight Logger, Splunk, and IBM QRadar; triage, correlate, and escalate alerts in a 24x7 SOC environment.
• Configure and maintain ArcSight dashboards, reports, and health checks; ensure continuous platform availability for SOC and CTI operations.
• Provide intelligence enrichment to SOC teams for active investigations; collaborate on detection use case improvement and alert tuning based on emerging threat intelligence.
• Coordinate with SOC and infrastructure teams to monitor vulnerabilities across Anti-Virus/Malware, IDS/IPS, Firewalls, Proxies, and endpoint security tooling.
• Own preparation and delivery of Daily, Weekly, and Monthly security intelligence reports for multiple clients; ensure accuracy, timeliness, and adherence to SLAs.
• Translate complex technical findings into clear, business-relevant summaries for client stakeholders, including threat advisories and incident notifications.
• Maintain daily SOC health checklists and track team deliverables to ensure consistency and quality standards across all client reporting.
• Identify reporting gaps and contribute to continuous improvement of intelligence workflows and documentation standards.
• Support incident response for security alerts and critical incidents across multiple clients; provide CTI context to accelerate triage and resolution.
• Assist in coordinating takedown operations for phishing sites, brand-impersonation domains, and malicious infrastructure identified through monitoring.
• Provide actionable recommendations to strengthen client security posture based on threat findings and emerging attack trends.
• Engage with clients to communicate threat exposure, potential impact, and defensive recommendations in both technical and non-technical formats.

BCA in Bachelor of Computer Applications

B.Com in Bachelor of Commerce