Ritesh Vishwakarma

Cybersecurity professional with 3.8+ years of experience across Security Operations, Cloud Security, Insider Risk Management and Data Security. Hands-on experience with Microsoft Sentinel, Microsoft Defender XDR, KQL, Azure Firewall, Defender for Cloud, Logic Apps and Microsoft Purview. Expertise in security monitoring, incident investigation and response, threat hunting, detection tuning, IOC handling, automation and security investigations across Azure and Microsoft 365 environments.

Strong foundation in MITRE ATT&CK and NIST-aligned security operations.

Senior Consultant – Cybersecurity - LTM (LTIMindtree)

(2025-12)

• Performed security monitoring, alert triage and incident investigation using Microsoft Sentinel and Microsoft Defender across identity, endpoint and cloud security environments.
• Utilized KQL for security investigations, log analysis and correlation of identity, endpoint and cloud telemetry to identify suspicious activities.
• Conducted KQL-based threat hunting to identify attack patterns, Indicators of Compromise (IOCs) and potential security threats.
• Developed and optimized KQL queries and Microsoft Sentinel Analytics Rules to improve detection accuracy and reduce false positives.
• Performed IOC analysis and threat intelligence investigation to validate suspicious IP addresses, domains, URLs and other security indicators.
• Investigated endpoint security alerts using Microsoft Defender for Endpoint, analyzing suspicious processes, activities and potential threats.
• Worked with Microsoft Purview Insider Risk Management (IRM) to investigate risky user activities, anomalous behavior and potential insider-threat indicators.
• Managed and investigated Microsoft Purview DLP alerts and policy violations, analyzing affected users, activities and data to determine security risk.
• Tuned DLP policies and detection controls to improve security monitoring and reduce false positives.
• Applied MITRE ATT&CK techniques during threat investigations and threat-hunting activities.
• Maintained incident investigation records, evidence, SOPs and security documentation to support security operations and audit requirements.

SOC Analyst - HCLTech - Noida

(2022-10 - 2025-12)

Clients/Projects: Mosaic, Azule Energy, Altera (Intel), DS Smith

• Delivered SOC and Microsoft Security operations across four enterprise clients, including security monitoring, incident investigation and response.
• Performed 24×7 security monitoring and incident investigation using Microsoft Sentinel and Microsoft 365 Defender.
• Fine-tuned Microsoft Sentinel Analytics Rules to improve detection accuracy and reduce false positives.
• Conducted KQL-based threat hunting to identify suspicious activities, attack patterns and potential security threats.
• Handled L2 security escalations and blocked Indicators of Compromise (IOCs) in accordance with incident-response procedures.
• Developed and maintained Azure Logic Apps and Sentinel Playbooks to automate alert triage, security workflows and incident-response processes.
• Configured and monitored Azure Firewall to strengthen network security and enforce traffic-filtering policies.
• Improved Microsoft Defender for Cloud security posture by implementing security recommendations and tracking Secure Score improvements.
• Performed vulnerability assessment, prioritization, remediation tracking and security validation.
• Managed PKI operations, including certificate generation, renewal, revocation and lifecycle management.
• Managed Microsoft Purview DLP policies, investigated DLP alerts and tuned policies to reduce false positives.
• Delivered knowledge-transfer sessions for L1 analysts and authored 30+ SOPs covering incident response, firewall administration, DLP investigations and security operations.
• Collaborated with cross-functional teams and client stakeholders for timely investigation, remediation and closure of security incidents.

B.Tech - Electronics & Communication Engineering - Bundelkhand University, Jhansi (2018 - 2022)