Yash Rathore

Monitored and triaged security alerts in Sumo Logic SIEM across multi-client enterprise environments; managed full incident lifecycle from detection through closure via Zendesk ticketing. Assisted in configuring SOAR-based automation for alert enrichment, IOC correlation, and escalation routing, contributing to reduced manual analyst overhead.

Authored and maintained SOC runbook documentation, standardizing investigation workflows and detection coverage guidance across the analyst team.

Triaged alerts across endpoint, identity, and network telemetry including Windows Event Logs and Sysmon; contributed to tuning 12+ Microsoft Sentinel detection rules, reducing false-positive volume through root-cause analysis. Contributed to 10+ SOC playbooks covering phishing, DNS tunneling, and DoS scenarios, each mapped to specific MITRE ATT & CK tactics and techniques.

Automated alert triage workflows in Tines and Shuffle using Python and Bash scripts, eliminating approximately 10 hours/week of repetitive manual enrichment effort. Conducted adversary simulations using Atomic Red Team and Caldera (alongside custom scripts) targeting credential access (T 1003), command execution (T 1059), valid accounts (T 1078), and WMI (T 1047); findings informed detection rule refinements.

Analyzed Wazuh alerts and event telemetry to surface anomalies, validate detection rule configurations, and support ongoing security monitoring operations. Produced client-facing security documentation including remediation guidance, findings summaries, and audit-ready evidence packages.