Tarun Teja Desireddy

Doha, Qatar · Onsite

• Deploy and configure Microsoft Sentinel workspaces, and onboard log sources and data connectors as new coverage comes online
• Author and tune KQL analytics rules, each mapped to a MITRE ATT&CK technique, and bring external threat-intelligence feeds in through Sentinel's ingestion APIs
• Run proactive, hypothesis-driven threat hunts in KQL, with hunt packages mapped across the MITRE ATT&CK matrix
• Build the SOAR layer: Logic App playbooks, Sentinel automation rules, and Azure Automation runbooks for enrichment, notification, and response, all authenticated by a Key Vault-backed managed identity
• Operate across three SIEMs: Microsoft Sentinel, Google SecOps (Chronicle), and LogRhythm
• Investigate across Azure workloads and identity using Microsoft Defender for Cloud, Microsoft Entra ID, Azure Monitor, and Log Analytics
• Own incident response on the high-severity cases: triage, root-cause analysis, SLA tracking, and Sentinel workbooks for operational reporting

Remote · India

• Monitored and investigated security alerts and incidents in Microsoft Sentinel on a 24/7 SOC rotation
• Performed initial triage to determine each incident's severity, impact, and business risk
• Investigated alerts using Sentinel investigation graphs, entities, incidents, and Log Analytics
• Wrote KQL to search and correlate events across Microsoft Defender, Entra ID, Windows Event Logs, Azure Activity logs, and firewall data
• Investigated phishing, brute-force, impossible-travel, malware, suspicious sign-in, and unauthorized-access alerts
• Analysed suspicious IPs, URLs, domains, and file hashes with VirusTotal, AbuseIPDB, WHOIS, and threat-intelligence platforms
• Followed SOC runbooks and SOPs, and recorded the investigation, actions taken, and recommendations in each incident ticket
• Ran basic threat hunts in KQL, mapped findings to MITRE ATT&CK, and fed false-positive patterns back into detection tuning while keeping to SLA