Neha Sanket

Cybersecurity professional with 5 years 9 months of overall IT experience, including 3+ years in Security Operations, backed by Linux administration and cloud/infrastructure operations in a telecom production environment. Experienced in SIEM monitoring, alert triage, event correlation, phishing and malware investigations, true-positive/false-positive classification, IOC validation, DNS and firewall log analysis, and incident escalation. Hands-on with Devo, Wazuh and Microsoft Defender EDR, including process-tree analysis and device isolation.

Familiar with MITRE ATT&CK, OSINT, sandbox analysis and basic KQL, with foundational knowledge of TCP/IP, DNS, HTTP/HTTPS and vulnerability assessment concepts. AWS exposure includes IAM, EC2, VPC and Security Groups.

Security Operations / SOC at VODAFONE IDEA LTD (2021-01 – 2026-10)

• Monitored and triaged security alerts across telecom production environments, assessed alert severity and relevance, correlated related events, and prioritised cases for investigation.
• Investigated phishing alerts and suspicious emails by reviewing indicators, validating URLs and domains, and using supporting intelligence to assess and escalate suspected malicious activity.
• Classified investigated alerts as true positives or false positives based on available evidence and documented the investigation rationale.
• Investigated suspicious IP addresses, domains, URLs and file hashes using OSINT sources to validate IOCs and enrich security alerts.
• Analysed DNS and firewall logs to investigate suspicious network activity, supported by understanding of TCP/IP and HTTP/HTTPS fundamentals.
• Used SIEM searches and queries in Devo and Wazuh to investigate events, correlate related activity and support alert analysis.
• Performed Microsoft Defender EDR investigations, including alert triage, process-tree analysis and investigation of suspicious endpoint activity.
• Supported endpoint response actions, including device isolation, incident containment and remediation in line with established processes.
• Performed static and dynamic analysis of suspicious files and URLs using sandbox tools to identify malicious characteristics and support malware investigations.
• Mapped observed activity to relevant MITRE ATT&CK tactics and techniques to add context to security investigations.
• Investigated unusual authentication, IAM and access activity across cloud and enterprise identity environments.
• Collected and documented investigation evidence, communicated findings to relevant teams, and escalated incidents when required.
• Managed 2,000+ Linux production servers, handling system monitoring, patching, troubleshooting and operational support.
• Administered Linux users, groups, permissions, SFTP/NFS services and disk/LVM resources while maintaining appropriate access controls.
• Automated routine administration activities using Bash and supported AWS infrastructure involving IAM, EC2, VPC and Security Groups.

B.E. in Electronics and Telecommunication Engineering – RMD Sinhgad College of Engineering (2017 – 2020)