Trayon Drummond
Dallas,TX
Summary
Cybersecurity SOC analyst with 5+ years of experience securing enterprise environments through rapid incident detection, threat investigation, and response. Correlates SIEM and EDR telemetry to identify indicators of compromise, reconstruct attacker activity, and drive containment and remediation. Expert in Microsoft Sentinel, Splunk, IBM QRadar, CrowdStrike Falcon, and Microsoft Defender.
Overview
1
1
Certification
6
6
years of professional experience
Work History
SOC Analyst
IBM
10.2024 - Current
- Triage high-volume security alerts across SIEM, EDR, email, network, DLP, identity, and cloud security platforms to prioritize response efforts.
- Analyze security events, alerts, and logs from various sources to identify and escalate potential security incidents for timely remediation.
- Analyze endpoint threats, suspicious processes, PowerShell activity, credential anomalies, persistence, and defense-evasion techniques.
- Use QRadar, Microsoft Defender, CrowdStrike Falcon, Splunk, and KQL/AQL to correlate events and identify indicators of compromise.
- Perform incident response actions including endpoint isolation, credential resets, session revocation, malware removal, containment, and remediation.
- Investigate phishing and DLP events involving malicious URLs, attachments, spoofing, credential harvesting, insider risk, and potential data loss.
- Document security incidents, investigations, and resolutions accurately and promptly to maintain comprehensive records for future reference.
Soc Analyst
McAfee
03.2024 - 10.2024
- Investigated endpoint threats, malware, phishing, suspicious processes, PowerShell activity, and credential-related incidents.
- Investigated IAM-related security events including anomalous authentication, credential compromise, and unauthorized access to protect enterprise and cloud environments from potential breaches.
- Monitored and triaged security alerts across SIEM, EDR, email, network, and DLP platforms to ensure timely threat identification.
- Executed response actions such as endpoint isolation, credential resets, session revocation, malware removal, and system reimagining to mitigate security incidents.
- Analyzed security events using CrowdStrike, Microsoft Defender, QRadar, Splunk, KQL/AQL, Zscaler, Palo Alto, Akamai, and Microsoft Purview DLP.
SOC Analyst
Robert Half
03.2023 - 03.2024
- Monitored and analyzed SIEM alerts, security logs, and network traffic to identify suspicious activity and indicators of compromise.
- Investigated security incidents and coordinated with cross-functional teams to support containment, remediation, and incident response.
- Streamlined alert triage and incident response workflows through automation and process refinement, enhancing overall effectiveness.
- Contributed to threat detection and real-time monitoring initiatives, strengthening network defense and enabling quicker responses.
- Developed incident reports and threat intelligence updates for technical teams and management, facilitating informed decision-making.
SOC Analyst
Trinity Metro
01.2021 - 03.2023
- Monitored security events across SIEM, EDR, email, cloud, and network security platforms, investigating potential threats to enhance incident response.
- Observed Microsoft Sentinel and Splunk Enterprise Security alerts across multi-client environments, prioritizing high-severity events and improving SLA compliance through structured triage and escalation.
- Analyzed phishing, malware, brute-force, impossible-travel, and privilege-escalation alerts, enriching indicators through threat intelligence and escalating confirmed incidents with concise evidence-based recommendations during investigations.
- Developed SIEM queries using Kusto Query Language (KQL), Search Processing Language (SPL), and regular expressions to reconstruct timelines and identify related malicious activity.
- Created technical documentation and automated workflows to streamline SOC operations and ensure consistent security procedures.
Education
B.S - Cybersecurity and Assurance
Western Governors University
12-2026
Cybersecurity Boot Camp -
The Academy of South Florida
02-2014
High School Diploma -
McArthur High School
05-2006
Skills
- SIEM: IBM QRadar, Microsoft Sentinel, Splunk
- EDR/XDR: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Cortex
- Security Operations: Incident Response, Threat Hunting, Alert Triage, Log Analysis, MITRE ATT&CK, Threat Intelligence
- Query Languages: KQL, AQL, SQL
- Email & DLP Security: Proofpoint, Mimecast, KnowBe4, Microsoft Purview
- Network & Web Security: Akamai, Zscaler, Palo Alto
- Cloud Security: AWS and Azure Fundamental, Google Cloud
- Case Management & Threat Intelligence: ServiceNow, ThreatConnect
Certification
CompTIA Security+ | CompTIA CySA+ | CompTIA A+ | Google Cybersecurity Professional Certificate
Timeline
SOC Analyst
IBM
10.2024 - Current
Soc Analyst
McAfee
03.2024 - 10.2024
SOC Analyst
Robert Half
03.2023 - 03.2024
SOC Analyst
Trinity Metro
01.2021 - 03.2023
B.S - Cybersecurity and Assurance
Western Governors University
Cybersecurity Boot Camp -
The Academy of South Florida
High School Diploma -
McArthur High School