Srikanth Nagula

Security analyst with 4.7 years of experience in Security Operations, Incident Response, Threat Hunting, and Microsoft Security technologies across enterprise environments. Proven expertise in Microsoft Sentinel, Microsoft Defender XDR, Microsoft Intune, Microsoft Entra ID, Exchange Online, Microsoft Purview DLP, and Zscaler, with hands-on experience in SIEM administration, detection engineering, endpoint security, email security, and identity & access management. Skilled in developing KQL/SPL detections, automation playbooks, log integrations, vulnerability management, and security operations optimization while reducing MTTD/MTTR and enhancing SOC maturity.

Strong knowledge of ISO 27001, NIST Cybersecurity Framework, and MITRE ATT&CK, with a track record of improving security posture through proactive threat detection, automation, and continuous process improvement.

Security Analyst - KPMG - Noida

(2022-01)

• Monitored enterprise security events using SIEM platforms to detect, analyze, and respond to cybersecurity threats across hybrid environments.
• Performed real-time monitoring, alert triage, and incident investigation while maintaining defined SLAs.
• Managed the complete incident response lifecycle including identification, containment, eradication, recovery, and post-incident review.
• Conducted Root Cause Analysis (RCA) for major security incidents and implemented preventive security measures.
• Maintained operational KPIs including MTTD, MTTR, and SLA compliance to improve SOC performance.
• Prepared daily handover reports and weekly/monthly executive security reports highlighting incidents, trends, and KPIs.
• Coordinated with cross-functional IT, Cloud, Network, and Infrastructure teams during critical security incidents.
• Investigated ransomware, malware, phishing, insider threats, privilege escalation, and lateral movement attacks.
• Performed proactive threat hunting using MITRE ATT&CK framework and threat intelligence.
• Conducted IOC-based threat hunting across endpoints, email, cloud, identity, and network environments.
• Blocked malicious IPs, domains, URLs, file hashes, email senders, and other IOCs across enterprise security platforms.
• Published security advisory reports and assessed organizational exposure to emerging vulnerabilities and threat campaigns.
• Administered Microsoft Sentinel for centralized security monitoring, incident management, and threat detection.
• Developed custom Analytics Rules using KQL, including Scheduled, Near Real-Time, and Fusion detections.
• Fine-tuned detection use cases to reduce false positives and improve detection accuracy.
• Created Microsoft Sentinel Automation Rules and Logic App Playbooks for automated incident response.
• Developed Sentinel Workbooks and dashboards for SOC monitoring and executive reporting.
• Configured Watchlists, Data Connectors, and threat intelligence integrations within Sentinel.
• Managed SIEM administration including connector health, parser validation, log normalization, and ingestion monitoring.
• Optimized SIEM performance, retention policies, and log management for operational efficiency.
• Integrated security logs from Microsoft 365, Defender, Entra ID, firewalls, cloud platforms, proxy servers, email gateways, and third-party security solutions.
• Configured Syslog, CEF, JSON, REST API, Event Hub, and Log Analytics-based log ingestion.
• Validated log parsing, field mapping, normalization, and troubleshooting of ingestion issues.
• Collaborated with application owners to onboard new log sources into the SIEM platform.
• Administered Microsoft Defender for Endpoint across Windows, macOS, Linux, Android, and iOS devices.
• Managed endpoint onboarding, offboarding, sensor health monitoring, and endpoint compliance.
• Performed EDR health checks and resolved endpoint communication and onboarding issues.
• Investigated endpoint security incidents involving malware, ransomware, exploits, and advanced persistent threats.
• Performed endpoint isolation, Live Response, antivirus remediation, and threat containment activities.
• Configured and managed Attack Surface Reduction (ASR) Rules to strengthen endpoint protection.
• Monitored device exposure scores, security recommendations, and enterprise security posture.
• Supported enterprise EDR migration projects including planning, deployment, validation, and post-migration support.
• Administered Microsoft Intune for enterprise endpoint management and security policy enforcement.
• Configured Device Compliance Policies, Configuration Profiles, Security Baselines, and Endpoint Security Policies.
• Managed BitLocker encryption, Windows Update Rings, Autopilot provisioning, and application deployments.
• Integrated Intune compliance with Conditional Access policies to enforce Zero Trust security.
• Administered Microsoft Exchange Online and Microsoft 365 email services for enterprise users.
• Managed mailbox provisioning, shared mailboxes, distribution groups, permissions, and lifecycle management.
• Configured mail flow rules, transport rules, connectors, accepted domains, and email routing.
• Performed message trace analysis and resolved email delivery and routing issues.
• Administered Microsoft Defender for Office 365 including Anti-Spam, Anti-Phishing, Safe Links, and Safe Attachments.
• Investigated phishing, Business Email Compromise (BEC), spoofing, malware attachments, and malicious email campaigns.
• Performed email header analysis using SPF, DKIM, and DMARC authentication mechanisms.
• Managed Tenant Allow/Block Lists (TABL), email quarantine, Threat Explorer investigations, and outbound spam policies.
• Administered Microsoft Purview Data Loss Prevention (DLP) policies across Microsoft 365 workloads.
• Configured Sensitive Information Types, policy tips, user notifications, and automated remediation actions.
• Tuned DLP policies to reduce false positives while ensuring regulatory compliance.
• Administered Zscaler Internet Access (ZIA) policies including URL filtering, SSL inspection, application control, and web access governance.
• Conducted enterprise vulnerability assessments and risk analysis using industry-standard vulnerability management tools.
• Prioritized remediation activities based on CVSS scores, exploitability, business impact, and asset criticality.
• Coordinated vulnerability remediation, patch validation, and compliance reporting with infrastructure teams.
• Administered Microsoft Entra ID for identity lifecycle management, authentication, and access governance.
• Implemented Role-Based Access Control (RBAC) following the Principle of Least Privilege.
• Configured Conditional Access Policies using device compliance, user risk, location, and application-based controls.
• Managed Multi-Factor Authentication (MFA), Single Sign-On (SSO), Enterprise Applications, and Privileged Identity Management (PIM).
• Investigated risky users, risky sign-ins, impossible travel events, and identity compromise alerts.
• Supported implementation of security controls aligned with ISO 27001, NIST Cybersecurity Framework (CSF), and organizational security standards.
• Participated in security audits, compliance assessments, risk assessments, evidence collection, and control validation activities.
• Developed advanced Kusto Query Language (KQL) and Splunk Processing Language (SPL) queries for threat hunting, investigations, dashboard creation, and detection engineering.
• Authored security documentation including SOPs, incident response runbooks, operational playbooks, and security best practices to enhance SOC maturity.
• Utilized Python, PowerShell, and Linux shell scripting to automate security operations, streamline incident response workflows, perform log analysis, and enhance SOC operational efficiency.
• Leveraged Python for security automation, PowerShell for Windows administration and endpoint management, and Linux CLI for system administration, log analysis, threat hunting, and security troubleshooting across enterprise environments.

M.Tech - K L University (2019 - 2019)