Paul Pambah

Information Security Analyst with 7 years of experience in Information Security Operations encompassing Risk Definition, Planning, Measuring, Implementation of Controls and Assessing their Effectiveness. Knowledgeable in Risk Assessment, Compliance and Audit, Security policies, and accustomed to NIST SP 800-53, NIST SP 800-171, CMMC 2.0 and SOC 2 frameworks. Seeking a position that offers professional challenges requiring problem-solving skills, strategic thinking, interpersonal and organizational skills.

Microsoft Defender Suite:

• Writing custom search and alerting rules based on intelligence, known artifacts or existing investigation.
• Defender for Identity – to investigate anomalous access or login activity, restricting access for compromised or termed accounts and enforcing access credential resets due to suspected or confirmed compromise.
• Defender for Cloud Apps – Setting customs alerts for anomalous cloud application behavior (i.e. new apps creation by unauthorized users, unauthorized access elevation, etc), investigating alerts and remediation.
• MDE vulnerability management for built-in continuous vulnerability scanning and suggesting remediation action such as scanning endpoints and servers for default accounts, guest accounts or cached credentials that pose access security risk and alerting for appropriate actions to minimize the risk. Detecting vulnerable applications and suggesting best practice actions
• Used Microsoft Defender Security Copilot to quickly generate efficient KQL queries for custom alerting or investigations as well as converting intelligence IOCs into use cases

Splunk:

• Incorporating Splunk base, ES and SOAR for consolidated view of the technology operating environment.
• Creating/ modifying custom alerting user cases and report for visibility and detection of suspicious or anomalous activity.
• Investigating alerts and incidents in ES
• Automating validated workflows/playbooks in SOAR to automate repetitive tasks
• Using Splunk AI app to write efficient searches as well as understand existing/new custom use cases so that we can modify them to suit current needs

Network Security:

• Used Riverbed Steel Central to monitor network performance activity. This would come in handy by detecting suspicious activity from external and internal threat sources.
• Used Palo Alto Network security to set up/modify firewall rules to restrict network traffic.
• Used Riverbed Packet Analyzer to capture and analyze network traffic

CrowdStrike:

• Monitoring endpoint activity for suspicious/anomalous activity.
• Investigating alerts to determine if they are real or false
• Ingesting artifacts/IOCs from intelligence sources as custom searches or alerts
• Using Real-Time Response (RTR) to access remote endpoints for collect artifacts, image dumps and uninstall malicious/suspicious applications.