richesh.top/services
Four disciplines.
One workflow.
Practical skills developed through day-to-day SOC work: platform support, investigation, containment and reporting. Pick a stage to see what happens there.
Currently applied as a security operations consultant at Atos Group (Eviden), supporting a client security environment from Pune.
Review the signal
Review security events and platform signals with operational context.
Security monitoring (SIEM)
Watching security alerts and system logs to spot activity that needs a closer look.
IBM QRadarMicrosoft SentinelMicrosoft DefenderThreat intelligence
Validate the activity
Follow the available evidence from the first alert through investigation and escalation.
Incident investigation
Following the evidence behind an alert to decide whether it is a real threat.
IOC analysisEndpoint investigationRecorded FutureEscalation
Phishing response
Confirming whether a suspicious email is malicious and containing the damage if it is.
Email analysisMicrosoft DefenderUser impact review
Coordinate the response
Take or coordinate authorised containment and remediation actions.
Endpoint containment (EDR)
Isolating an affected computer so a threat cannot spread, with proper authorisation.
CrowdStrike FalconCarbon BlackHost quarantine
Data loss prevention (DLP)
Reviewing and handling authorised requests around rules that stop sensitive data leaving.
TrellixPolicy exceptionsData-owner coordination
Keep the record clear
Document incidents and operational activity in a direct, decision-ready format.
Security reporting
Turning incidents and alert trends into clear reports that leaders can act on.
Monthly matrix reportingInvestigation write-upsStakeholder updates
Platforms in daily use
| PLATFORM | STAGE |
|---|---|
| IBM QRadar | MONITOR |
| Microsoft Sentinel | MONITOR |
| Microsoft Defender | MONITOR · INVESTIGATE |
| Recorded Future | INVESTIGATE |
| CrowdStrike Falcon | CONTAIN |
| Carbon Black | CONTAIN |
| Trellix | CONTAIN |
Certifications
CompTIA Security+ (SY0-601)
CompTIA · Issued 2023
AWS Certified Cloud Practitioner
Amazon Web Services · Issued 2024
Need a steady hand in the SOC?
Open to conversations about security operations, incident investigation, SIEM, phishing response, endpoint security and the move into AI security.