Veeranala Bhan

Security Analyst with 5+ years of experience in 24×7 Security Operations Center (SOC) environments, supporting L1 and L2 operations across enterprise infrastructures. Proven expertise in SIEM monitoring, incident detection and response, endpoint security (EDR/XDR), phishing and email threat analysis, vulnerability management, and threat hunting. Strong hands-on experience with QRadar, Splunk, Microsoft Sentinel, CrowdStrike Falcon, SentinelOne, and Microsoft Defender for Endpoint.

Adept at collaborating with SOC teams, vendors, and stakeholders to ensure timely incident resolution, SLA compliance, and continuous security posture improvement.

Security Analyst at Cognizant Technology Solutions (2024-10 – Present)

• Operate as a SOC Analyst supporting both L1 and L2 operations within a 24×7 enterprise SOC environment.
• Perform real-time monitoring and initial alert triage (L1) across SIEM platforms to identify suspicious activities and potential security incidents.
• Conduct L2-level investigations for confirmed threats including malware infections, phishing attacks, endpoint compromise, suspicious process execution, and account misuse.
• Investigate alerts using EDR/XDR tools such as CrowdStrike Falcon, SentinelOne, and Microsoft Defender for Endpoint, performing root cause and impact analysis.
• Manage the incident response lifecycle: validation, containment, eradication, recovery, and post-incident reporting in accordance with SOC playbooks and SLAs.
• Analyze logs from endpoints, firewalls, email gateways, cloud services, and SIEM to correlate events and determine malicious activity.
• Perform phishing and email security investigations using Proofpoint, Mimecast, Cofense, IronPort, and O365 Defender, including header analysis, URL detonation, and attachment inspection.
• Support SIEM rule tuning and alert optimization, reducing false positives and improving detection accuracy aligned with MITRE ATT&CK techniques.
• Participate in threat hunting activities to proactively identify anomalous behavior and hidden threats.
• Review vulnerability assessment reports from Nessus/Qualys and assist remediation teams with risk-based prioritization.
• Document incidents, evidence, timelines, and remediation actions using ServiceNow and Jira for audit and compliance purposes.
• Escalate high-severity incidents to SOC leads and stakeholders with clear findings and recommendations.
• Provide guidance to SOC L1 analysts, improving triage quality and escalation accuracy.

Security Analyst at Real Time Data Services (2024-07 – 2024-10)

• Monitored and analyzed SIEM alerts, supporting L1 and L2 security investigations across endpoint, network, and email security domains.
• Developed and maintained SIEM use cases and detection logic aligned with evolving threat landscapes.
• Conducted endpoint and malware investigations using EDR tools and sandbox analysis.
• Investigated phishing incidents and email-based threats using secure email gateways.
• Contributed to threat intelligence research and detection improvement initiatives.

Cyber Security Analyst at Accenture (2020-04 – 2024-06)

• Supported enterprise SOC operations by investigating security incidents across endpoints, networks, and cloud environments.
• Conducted forensic analysis to identify attack vectors, impacted assets, and remediation actions.
• Utilized IBM QRadar and Splunk for alert correlation, log analysis, and incident validation.
• Mentored and supported SOC L1 teams, ensuring adherence to investigation and escalation procedures.
• Coordinated with internal stakeholders and SOC vendors during high-severity incidents.
• Improved SOC efficiency through process optimization, playbook refinement, and workflow enhancements.
• Maintained incident metrics, KPIs, and reports to track SOC performance and trends.
• Worked in multi-vendor security environments, supporting tool integrations and operational alignment.

Bachelor's Degree – Pacific Institute of Engineering and Management (2016 – 2019)