Kiran Pyati

7+ Years of hands-on Experience in Security Operations.

Incident

Response, Endpoint Security, Phishing analysis, Threat Intelligence, IT IS, Network Security. Good understanding of log formats of various devices such as Web sense, Vulnerability Management Products, IDS/IPS, EDR, Firewalls, WAF, Proxy, Routers, Switches, OS, DB Servers, and Antivirus.

Experience in Information Security with emphasis on security operations, Log monitoring, Log management, incident management, and security event analysis through Sentinel & Splunk SIEMs. Analyzing the detections and incidents from EDR solutions like CrowdStrike, MS defender and containing the machines and providing real-time response. Having experience in handling incident response in Linux OS and troubleshooting accordingly.

Having experience in developing Security content like rules, reports, dashboards in SIEM.

Experience in generating Daily, Weekly & Monthly Reports from Sentinel and Splunk and communicating to stakeholders. Agile in investigating security threats such as Malware Outbreaks, DDOS, OWASP T-10 and Phishing Analysis on the network. Having knowledge in integrating log sources along with SIEM and parser creation.

Performing the effective phishing analysis and performing phishing campaign using Knowbe4, TrendMicro Vision One, Deep Security, Apex One, DDAN KQL, MDE, Tenable, and MITRE ATT&CK, Basic knowledge of Azure Infrastructure, M365, and Intune, Firewalls: Palo Alto and I.

SECURITY ANALYST - OPTIV. - Bengaluru, India

(2025-07 - 2026-08)

• Client 1: Enterprise Security Operations (Google SecOps & CrowdStrike Falcon)
• Monitored and analysed real-time security alerts using Google SecOps (Chronicle), optimizing detection rules and reducing false positives to improve incident response efficiency.
• Managed endpoint threat detection and response using CrowdStrike Falcon, performing rapid isolation, threat containment, and malware analysis across enterprise endpoints.
• Triaged and investigated complex security incidents across network, identity, and cloud environments, executing end-to-end incident response workflows to mitigate active threats.
• Conducted threat hunting initiatives by leveraging Google SecOps log correlation and CrowdStrike telemetry to proactively identify persistent advanced threats (APTs).
• Client 2: Managed Security Services (Microsoft Sentinel)
• Architected, configured, and managed threat monitoring workflows within Microsoft Sentinel, integrating multiple cloud and on-premises log sources for comprehensive SIEM visibility.
• Developed custom KQL (Kusto Query Language) queries, analytics rules, and workbooks in Sentinel to detect anomalous behaviours and zero-day vulnerabilities.
• Streamlined Security Operations Centre (SOC) operations by automating incident triage and response tasks via Microsoft Sentinel playbooks and Azure Logic Apps.
• Collaborated with client stakeholders to perform root-cause analysis on critical incidents, delivering actionable remediation guidance and post-incident reports.
• Core Impact & Cross-Client Metrics (Optional Additions)
• Handled the full incident response lifecycle (Identification, Containment, Eradication, and Recovery) for high-severity security incidents across diverse client environments.
• Decreased Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) by refining SIEM detection logic and standardizing EDR response playbooks.
• Proofpoint (Secure Email Gateway & Email Security)
• Email Gateway Administration & Rule Tuning: Configured and maintained Proofpoint Email Security gateway policies, customizing spam filters, content rules, and blocklists to enforce email security policies.
• Malware & Phishing Mitigation: Analysed malicious email attachments, URL rewriting telemetries (Targeted Attack Protection / TAP), and email headers to mitigate credential harvesting and malware delivery campaigns.
• Quarantine Management & False Positive Reduction: Managed Proofpoint threat quarantines, conducting rapid analysis of held messages to reduce false positives while preventing malicious payloads from reaching end-user inboxes.
• Domain Security & Authentication: Monitored email authentication protocols (SPF, DKIM, and DMARC) via Proofpoint to block spoofing and unauthorized domain usage.
• Incident Response & Triage: Leveraged Proofpoint Threat Response Auto-Pull (TRAP) to automate post-delivery email quarantines and eradicate weaponized emails across affected mailboxes.

SECURITY ANALYST - Voya India. - Bengaluru, India

(2024-09 - 2025-06)

• Architect and optimize Splunk environments, ensuring maximum system performance and reliability.
• Develop and manage Splunk indexes and data inputs for seamless data ingestion. Administer user roles and permissions, enhancing security and compliance. Monitor Splunk system health and troubleshoot issues proactively.
• I have created many change Requests to upgrade all the rsyslog, and windows servers of Splunk make sure all the logs will flow properly and I shave upgraded all the servers to n1 version And I have mitigated more than 100 vulnerabilities.
• I have monitored health check dashboard where we use to solve all the outages triggered in the dashboard
• Collaborate with IT and security teams to ensure the Splunk platform meets operational needs. Establish data parsing and extraction processes to enhance search capabilities. Create and optimize alerts and dashboards, providing actionable insights for stakeholders.
• End point "Leveraged CrowdStrike to detect and respond to ransomware attacks, reducing MTTR by 15%". "Utilized Microsoft Defender for Endpoint to identify and isolate compromised devices, preventing the spread of malware".
• "Developed and implemented automated remediation workflows for EDR alerts using Python scripts, resulting in a 20% reduction in manual effort". "Conducted threat hunting activities using Microsoft defender to identify and remediate previously unknown threats". "Integrated Microsoft defender with SIEM for improved threat visibility and correlation"
• Proofpoint Email DLP detects sensitive data and confidential information. And it keeps it from leaking outside your organisation through email. It accurately identifies sensitive information, detects data exfiltration transmissions via email, and stops critical data loss.

SECURITY ANALYST - Computer Generated Solutions Inc. - Bengaluru, India

(2020-01 - 2024-08)

• perform incident response analysis to uncover attack vectors involving a variety, of malware, data exposure, phishing, and social engineering methods
• Monitor security alerts received from SIEM or other security tools like EDR, DLP, email gateway, proxy, IDS/IPS, firewall, threat intelligence, etc.
• Carry out Level 2 triage of incoming incidents (initial IR assessment of the priority of the event, initial determination of incident nature to determine risk and damage, or appropriate routing of a security or privacy data request)
• Providing threat/vulnerability analysis and security logs from larger number of security devices In addition to investigate Incident Response support when there is a threat Investigating and monitoring Network traffic /IDS / Firewall / Endpoint security logs using IBM Qradar and Splunk Insider threat and APT detection or understanding/ differentiation of intrusion attempts& false alarms.
• Composing security alert notifications raising ticket to higher officials in ticketing tool Advise incident responders/ other teams on threat and providing evidence and information and tracking the threat resolution Email analysis using various open-source tools such as MX Toolbox, redirectdetective.com
• Perform malware analysis technique such as static and dynamic to understand and mitigate the effect of worms and virus detected by the end point security and isolate them by creating lab environment s and box and too Identifying and prioritizing vulnerabilities in the network Analysis of notables triggered and taking necessary actions Based on the request related to incident, searching, fetching and sharing the logs to the concerned team
• Basic search in Splunk and using the fields, using the tags in Splunk and Have knowledge on creating the dashboards and use cases Monitoring the logs from end devices and investigate offenses or any malicious traffic is observed, then taking an appropriate action involving respective tower (if necessary) based on analysis
• Log source integration (Windows, Linux and Network devices) to QRadar Analyzing and Troubleshooting the issues related to web content filtering
• Allowing, Whitelisting or blocking the URL, domain or IP's based on the request Monitoring the dashboards related to health monitoring of the Log database, log server, Filtering service and Directory service, database updates
• Fetching, sharing the logs using for analysis and if requested respectively
• Investigating the suspicious mail and taking necessary actions such as blocking the IP's, URL's, source, sender's mail ID etc by coordinating with different teams
• Malicious URL's and domains, Bad Reputed Ip's, Suspicious Email ID and Domain, malicious attached documents hash values details updating in Truster and integrated the same with SIEM to identify the malicious traffic entering into the network.

SYSTEM ADMINISTRATOR - Computer Generated Solutions Inc. - Bengaluru, India

(2018-07 - 2019-12)

• Provide regular technical support, install, and fix PCs, laptops, printers, scanners, mobile devices, and other computer assets in an organization.
• Installation and troubleshooting of Antivirus software.
• Good knowledge on outlook client. Backups, restores for maintenance servers and Active directories.
• Keeping updated, accurate and reliable backups of application and databases.
• Troubleshooting, Diagnosing malfunctions in the operation of hardware and software.
• Maintain all the assets and update asset database at regular intervals.
• Troubleshooting and support LAN / VPN issues for employees. Basic Troubleshooting experience on Linux/Unix

Bachelor Of Engineering - Computer Science - Bapuji Institute Of Engineering College (2017-12)