简介

工作经历

• l1 soc analyst - incident monitoring & response

  PASHA Bank OJSC

  2021.07-至今

  (5 年)

  One of the largest commercial banks in Azerbaijan. 16-person SOC organization (L1/L2 analysts, security engineers, team leads) operating 24/7 with single-analyst rotating shift coverage. • Independently handle 200+ security alerts per morning shift as the sole on-shift analyst, maintaining an average response time under 4 minutes and meeting SLA targets without team support during shift hours. • Triage and investigate incidents across the full enterprise security stack: IBM QRadar (primary SIEM), Cortex XDR (EDR), Trend Micro Deep Security (anti-malware, DDI sandbox), IBM Guardium (database activity monitoring), Forcepoint DLP, and FortiGate / Palo Alto firewalls. • Work with alerts mapped to the MITRE ATT&CK framework across multiple tactic categories — Initial Access, Execution, Credential Access, Discovery, Lateral Movement, Defense Evasion, and Exfiltration — enabling threat-informed prioritization. • Investigate phishing emails, malicious artifacts, suspicious domains, and IP reputation using OSINT, X-Force Threat Intelligence, sandbox detonation, and internal tooling; deliver precise remediation recommendations based on full root-cause analysis. • Operate against documented playbooks to ensure consistent, repeatable response across the SOC; escalate qualified incidents to L2/L3 with comprehensive evidence, timelines, and IOCs. • Review and triage PCI DSS-scoped alerts, supporting the bank's compliance posture and ensuring incidents afecting cardholder data environments receive priority handling. • Monitor DLP, EPM, and database activity events to identify data exfiltration atempts, unauthorized access, insider risk indicators, and policy violations across the enterprise. • Handle detections across hybrid cloud environments — Azure (Entra ID, sign-in logs, conditional access), AWS, and GitHub — including impossible-traveler, privileged login, and configuration-change scenarios. • Onboard and mentor new SOC analysts joining the team — walking them through tooling, alert handling workflows, escalation procedures, and shift handover practices. • Maintain detailed incident documentation in Jira and contribute to knowledge-base articles to reduce mean time to resolution (MTTR) and standardize response across shifts.

教育经历

• Georgian Technical University, Tbilisi, Georgia

  Mining and Oil & Gas Technologies

  2015.09-2019.06

  (4 年)

  Bachelor of Science in Mining and Oil & Gas Technologies, Georgian Technical University.

证书