Sai Ramakrishna Bathula

Security Analyst with 2.6 years of experience in enterprise security monitoring and incident response. Strong expertise in Microsoft Sentinel and Splunk for security event correlation, alert investigation, and threat detection. Hands-on experience with SentinelOne and Microsoft Defender for endpoint detection and response.

Skilled in vulnerability management using Qualys, including vulnerability assessment and remediation tracking. Proven experience in Azure cloud security monitoring, identity protection, and log analysis. Well-versed in email security operations using Proofpoint, phishing analysis, and data protection controls.

Adept in IDS/IPS, DLP monitoring, threat intelligence, and SOC automation support.

SOC Analyst - TCS - Bengaluru

(2025-07)

• Monitored, triaged, and correlated high-volume security events using Microsoft Sentinel and CrowdStrike Next-Gen SIEM within a 24x7 SOC, ensuring timely detection, validation, and SLA-driven escalation of security incidents.
• Designed, developed, and fine-tuned advanced KQL queries and analytics rules to improve threat detection accuracy, reduce false positives, and enhance security visibility across enterprise environments.
• Investigated and contained endpoint security incidents using Microsoft Defender and SentinelOne, handling ransomware outbreaks, malware infections, persistence mechanisms, and lateral movement attempts.
• Executed endpoint isolation, IOC sweeping, forensic triage, and coordinated remediation activities to ensure complete threat eradication and system restoration.
• Led detailed phishing investigations leveraging Proofpoint, analyzing email headers, payload behavior, malicious URLs, and attachments using threat intelligence platforms such as VirusTotal and AbuseIPDB.
• Monitored and analyzed DLP alerts, identifying data exfiltration attempts, policy violations, and insider threat indicators while supporting data protection and compliance requirements.
• Performed risk-based vulnerability analysis using Qualys, prioritizing critical CVEs (CVSS-based), validating patch deployments, and tracking remediation in coordination with infrastructure teams.
• Reviewed and analyzed Azure AD sign-in logs, audit logs, and Defender for Cloud alerts to detect anomalous authentication patterns, privilege escalation, brute-force attempts, and cloud misconfigurations.
• Enriched and validated security alerts using threat intelligence feeds, mapping IOCs to the MITRE ATT&CK framework to determine attacker tactics, techniques, and procedures (TTPs).
• Conducted in-depth analysis of IDS/IPS alerts, identifying reconnaissance activities, command-and-control communication, and suspicious network traffic patterns.

Senior Analyst - HCL Tech

(2023-12 - 2025-06)

• Respond to security incidents in a timely and efficient manner, taking appropriate mitigation actions to minimize damage.
• Analyse the logs in CrowdStrike, TM Apex One (EDR), Zscaler and providing the report to clients.
• Mitigate the CnC callbacks/ malicious traffic generated by Zscaler and Apex Central.
• Engaging in weekly meetings and delivering client reports for better insights.
• Configuring firewall security policies to allow/ block IP, ports, and Utilizing crowdStrike and trendMicro to correlate and investigate the alerts.
• Analysing security incidents generated by TrendMicro, CrowdStrike, Zscaler and phishing emails detected by Cloud App Security TM / Abnormal and reported by users.
• Based on the severity of the incidents, all the incidents have been investigated in time and remediated as per SLA.
• Experience in generating daily, weekly reports of data from TM Vision One, Zscaler and Abnormal.
• Ability to analyze different IOCs like allowing and blocking IOCs based on the client requirements.
• Monitored sign-in logs and audit logs in Entra ID for suspicious authentication patterns and brute-force attempts.

Bachelor of Computer Applications - Computer Applications - Aditya Degree College (2020)