Vamsidhar Bheemasaala
Cyber Security Analyst
Security Analyst with 3+ years in SOC environments specializing in threat hunting, detection engineering, threat intelligence integration, and real-time security monitoring. Skilled in log collection and normalization using SIEM platforms like Microsoft Sentinel and Palo Alto XSIAM, Endpoint Detection and Response (EDR) tools such as CrowdStrike and SentinelOne, and Extended Detection and Response (XDR) platforms, tuning alerts and blocking IOCs to reduce false positives. Experienced in incident response and engineering detection rules, driven by actionable threat intelligence, to enhance organizational defenses.
Skills
Microsoft Sentinel (KQLUEBAAutomation RulesLogic Apps)Palo Alto XSIAMLog correlationalert tuningKQL-based hunting queriesand threat intelligence-driven detection engineering.CrowdStrikeSentinelOneMicrosoft Defender for EndpointMicrosoft DefenderPalo AltoFortiGateSophosJuniperProofpointCisco RoutersNext Generation FirewallCheckpointSNORT IPSCloudflareAkamai AdvancedF5ImpervaAWS WAFNetskopeSymantec AntivirusMcAfee ePOServiceNow (Ticketing)SandboxingMicrosoft Entra IDReal-Time Security MonitoringIncident ResponseIncident Lifecycle ManagementThreat HuntingLinux
Experience
Security Analyst
Jan 2026 — PresentNTT Managed Services India Private Limited / India
- Monitored multiple distributed enterprise client environments using Palo Alto SIEM and Microsoft Sentinel solutions.
- Performed continuous real-time security event monitoring, alert triage, and high-fidelity validation to isolate true security
- incidents.
- Investigated critical security alerts via deep-dive analysis of event logs, network traffic, endpoint telemetry, and threat
- intelligence feeds.
- Managed security incident lifecycles within ServiceNow, coordinating seamlessly with cross-functional technical groups.
- Collaborated with platform engineering teams to fine-tune detection rules, reducing false-positive alerts and enhancing
- detection accuracy.
- Executed prompt incident response actions using EDR platforms (CrowdStrike, SentinelOne, Microsoft Defender XDR),
- including endpoint isolation, malicious process termination, and live terminal forensic collection.
- Wrote and refined Kusto Query Language (KQL) hunting queries within Microsoft Sentinel to surface anomalous activity
- and accelerate alert investigation.
- Leveraged User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel to flag anomalous identity activity,
- correlating findings with Microsoft Entra ID and Defender for Identity signals.
- Configured Sentinel Automation Rules and Logic Apps playbooks to streamline routine alert triage and reduce manual
- incident-handling time.
- Monitored the operational availability, health checks, and flawless log ingestion across distributed security devices and
- architectures.
- Conducted proactive threat hunting mapped against the MITRE ATT&CK framework, leveraging threat intelligence
- sources to pinpoint and prioritize emerging indicators of compromise (IOCs) for blocking.
- Documented comprehensive post-incident reviews detailing investigation findings, detailed timelines, and preventative
- remediation controls.
- Generated operational weekly and monthly security reports highlighting incident trends, response metrics, and firm
- cybersecurity posture.
- Assisted in third-party vendor cybersecurity posture assessment reviews to ensure strict organizational standard
- compliance.
- Engineered and tuned detection rules within Microsoft Sentinel and Palo Alto XSIAM to enhance detection accuracy and
- reduce false positives.
SOC Analyst
Nov 2023 — Jan 2026SISA Information Security Private Limited / India
- Conducted real-time monitoring and structural analysis of security events across network devices, Firewalls, IDS/IPS,
- Proxies, and Active Directory.
- Leveraged SIEM and Managed Extended Detection and Response (MXDR) tools for effective structural log aggregation,
- parsing, alert development and tuning, and correlation monitoring.
- Investigated, escalated, and delivered precise remediation recommendations throughout the entire containment,
- eradication, and recovery lifecycle.
- Analyzed low-fidelity alerts systematically to minimize queue metrics, and compiled daily firewall traffic patterns and
- operational reports.
- Managed tool log stoppage incidents, asset onboarding integrations, white-listing workflows, and routine health checks.
- Analyzed suspected phishing vectors using open-source intelligence (OSINT) tools and threat intelligence sources to
- block malicious payloads, identify IOCs, and prevent social engineering attempts.
- Provided technical mentorship and onboarding to junior SOC team members while maintaining absolute data privacy
- across security operations.
Cybersecurity Apprentice (SOC Operations)
Apr 2023 — Oct 2023SOCEXPERTS / India
- Participated in an intensive SOC apprenticeship program focused on hands-on threat monitoring, log analysis, and
- incident lifecycle management.
- Utilized Splunk for centralized log aggregation, data ingestion workflows, and engineering correlation alerts to track
- network behavior.
- Triaged simulated security alerts across endpoints and firewalls to map adversary techniques using the MITRE ATT&CK
- framework.
Education
Bachelor of Technology (B.Tech), Electronics and Communication Engineering
SRES Tirupati (Affiliated to JNTU Anantapur) / India
2020 — 2023