Tanzeel Ahmed Mohammed

SOC Analyst with hands-on experience monitoring, investigating, and responding to cyber threats across endpoint, cloud, and identity environments, triaging alerts to determine scope, severity, and business impact. Skilled in analyzing logs to identify indicators of compromise and suspicious activity, supporting incident response through containment, eradication, and recovery, and maintaining accurate investigation documentation.

Experience writing and tuning KQL queries in Microsoft Sentinel for detection and investigation, and applying MITRE ATT&CK and NIST framework knowledge to security analysis. Proficient in Microsoft Sentinel (SIEM), Microsoft Defender (EDR), Qualys (vulnerability management), and Entra ID (identity and access management), with foundational networking knowledge (TCP/IP, DNS, VPN, firewalls) and working knowledge of Microsoft Azure cloud environments. SC-200 and CCNA certified with a Master's degree in Information Studies; clear communicator comfortable supporting a 24/7 rotating shift schedule.

Jr. SOC Analyst - Securetek - San Antonio, Texas (Remote)

(2025-07 - 2026-04)

• Monitored, investigated, and responded to cyber threats across endpoint, cloud, and identity environments using Microsoft Sentinel (SIEM) and Microsoft Defender (EDR).
• Investigated and validated security alerts to determine scope, severity, and business impact, escalating high-risk incidents per established playbooks and procedures.
• Analyzed logs across endpoint and identity platforms to identify indicators of compromise and suspicious activity, applying MITRE ATT&CK and NIST framework knowledge.
• Wrote and tuned KQL queries in Microsoft Sentinel to support detection and investigation, improving alert quality and reducing false positives.
• Supported incident response efforts through containment, eradication, recovery, and post-incident documentation, maintaining accurate investigation records.
• Assisted with proactive threat hunting activities and continuous improvement of detection rules, and performed vulnerability assessments using Qualys.
• Communicated technical findings and response recommendations clearly to internal teams, and managed identity-related tasks through Microsoft Entra ID within Azure environments.

Process Associate (IT Technical Support) - Genpact - Hyderabad, India

(2022-12 - 2023-11)

• Diagnosed and resolved client technical incidents, including DNS A record mismatches and SSL rekey procedures, and accessed client environments remotely to perform certificate and server configuration changes.
• Developed knowledge base documentation and standardized playbooks for recurring issue resolution, and registered domains, SSL certificates, and servers as part of secure onboarding workflows.

Master of Science - Information Studies - Trine University