Mohammad Abdul Basith

Security-focused analyst with 4+ years monitoring, investigating, and triaging DLP alerts across Web, Email, Endpoint, USB, Print, and Cloud channels. Hands-on with Forcepoint DLP and Zscaler DLP administration alongside Symantec DLP, Symantec Endpoint Protection, and Microsoft Defender for Cloud, backed by a strong SQL-driven investigation and automation background across Azure and on-premises SQL Server. Experienced in policy creation and tuning (dictionaries, EDM/IDM, regex, classifiers), exception governance, SLA-driven incident response, and major incident/RCA.

Cut false positives and open incidents by up to 80% monthly through proactive triage, while managing ServiceNow ticketing end-to-end and mentoring a 6-person team.

System Engineer — Security Analytics & Data Protection (Functioning as Security Analyst) at Tata Consultancy Services (TCS) (2022-07 – Present)

• Monitor and triage DLP alerts across Web, Email, Endpoint, USB, Print, and Cloud channels using Forcepoint DLP and Zscaler DLP, validating true positives versus false positives and cutting monthly false positives and open incidents by up to 80%.
• Create, modify, and test DLP policies, dictionaries, EDM/IDM rules, regex patterns, and classifiers; perform policy tuning and periodic effectiveness reviews to improve detection accuracy.
• Investigate and triage high-risk user activity alerts — including impossible-travel patterns, location masking, and unauthorized access attempts — escalating confirmed risks with documented, audit-ready evidence.
• Manage ServiceNow incidents, requests, changes, and problem tickets, ensuring SLA adherence for incident response and closure activities.
• Process DLP exception requests through approved governance workflows; maintain exception inventories and perform periodic recertification.
• Support Forcepoint and Zscaler DLP platform administration, including agent/console health monitoring, policy sync, and upgrade/migration activities.
• Write and optimize SQL queries, stored procedures, and triggers on MS SQL Server (Azure and on-premises) to validate, reconcile, and analyze large volumes of security event and user activity data.
• Integrate new data sources from Splunk and MuleSoft APIs and build Power BI dashboards to visualize security trends and support stakeholder decision-making.
• Participate in major incident management and root-cause analysis activities, coordinating with Infrastructure, Security Operations, Privacy, Compliance, and Business stakeholders.
• Build and maintain automated Elastic jobs and database processes, reducing manual effort on recurring security operations tasks, while mentoring a team of 6 associates.

B.Tech in Civil Engineering – Anurag Group of Institutions (2022)