Arbab Khan

Background

About Arbab Khan

Monitor and analyze real-time security alerts using SIEM tools such as IBM QRadar and Azure Sentinel to detect and respond to potential threats. • Work with multiple security tools, including SIEM, EDR, XDR, dark web monitoring platforms, Azure Security tools, and email defenders, for proactive threat detection and response. • Investigate and respond to phishing incidents by analyzing email headers, URLs, and attachments, and recommend preventive measures to reduce user risk. • Manage endpoint protection using CrowdStrike Falcon (EDR) — ensuring agent deployment, host onboarding/decommissioning, troubleshooting, and isolating compromised systems. • Utilize IBM SOAR to close offenses, execute automated playbooks, and raise tickets to collect additional data required for investigations. • Create and manage SecOps tickets using tools like Jira, ServiceDesk Plus, and other ticketing platforms for incident tracking and coordination. • Create detailed Incident Response (IR) reports for all confirmed (true positive) cases, documenting root cause, impact, and remediation actions. • Perform Vulnerability Assessment, share findings with server/application owners, ensure timely remediation, and follow the full vulnerability management cycle. • Maintain and validate SIEM log sources, coordinating with server owners to ensure accurate and complete log ingestion. • Provide knowledge transfer (KT) sessions to new analysts for smoother onboarding and consistent process understanding. • Collaborate with IT, application, and OEM teams to resolve issues, fine-tune alerts, and enhance overall security operations.