Sairam Koduru

Security Analyst at Cybrowse Digital Solutions (2025-04 – Present)

Investigated and triaged security alerts involving phishing, suspicious authentication, endpoint activity, and network threats using Microsoft Sentinel, Splunk, and Microsoft Defender for Endpoint.
Correlated Windows Security Event Logs, endpoint telemetry, authentication activity, and network indicators using KQL and SPL to determine attack patterns, validate suspicious activity, and distinguish true positives from false positives.
Analyzed suspicious users, source IPs, domains, URLs, processes, and file activity during investigations; validated IOCs using VirusTotal, AbuseIPDB, MXToolbox, and other threat-intelligence sources.
Investigated authentication anomalies using Windows Event IDs 4624 and 4625, identifying repeated failed logins, unusual successful logins, and suspicious access patterns for escalation and containment.
Investigated suspicious process execution using Windows Event ID 4688 and endpoint telemetry to identify unusual executables, parent-child process relationships, and potentially malicious activity.
Managed investigations from initial alert triage through evidence collection, validation, documentation, escalation, and closure while maintaining clear case notes and investigation timelines.

Security Associate at Cybrowse Digital Solutions (2024-02 – 2025-04)

Performed first-line SOC alert triage across phishing, authentication, endpoint, and network security events, reviewing alert context and associated logs before determining escalation requirements.
Analyzed Windows Security Event Logs including Event IDs 4624, 4625, and 4688 to investigate successful and failed authentication attempts and suspicious process execution.
Performed IOC enrichment for suspicious IP addresses, domains, URLs, and file hashes using VirusTotal, AbuseIPDB, and MXToolbox to support incident validation and reduce false positives.
Investigated phishing indicators including sender information, URLs, domains, email authentication results, and reputation data to determine whether reported messages were malicious or legitimate.
Documented investigation findings, supporting evidence, and recommended actions before escalating confirmed or high-risk incidents to senior analysts for further response.

About