Security operations professional with 24/7 network and security operations experience at IBM (Tier-1 telecom accounts: Lumen, Verizon) and a Postgraduate in Cyber Security (RQF Level 7) from Swansea University, UK. I build hands-on Azure security labs to practise detection, response and identity hardening, and I'm preparing for Microsoft SC-200.
📫 uditprak226@gmail.com · LinkedIn · Open to relocation (Ireland, UK, Netherlands, Germany, Luxembourg, Sweden) and roles in India
- Threat detection: analysing Windows security logs (Event IDs 4625 / 4624) in Microsoft Sentinel with KQL to spot brute-force patterns.
- Incident response: triage, escalation and containment within SLA, from 24/7 rotational shifts at IBM.
- Automation: Azure Logic Apps playbooks triggered by Sentinel incidents.
- Identity security: MFA and just-in-time admin access with Entra ID Privileged Identity Management.
- Secure admin access: Azure Bastion deployment that removes public RDP/SSH exposure; VNet designed to be Hub-and-Spoke ready.
- Privileged access governance: PIM eligible assignments with MFA, justification and time-bound activation.
| Project | What it shows | Status |
|---|---|---|
| Sentinel SIEM & SOAR Lab | Azure honeypot, ~490 RDP brute-force attempts from 7 countries, KQL detection rule, Logic Apps playbook | Complete |
| Azure PIM Lab | Just-in-time Security Administrator role with MFA + justification | Complete |
| Azure Bastion Lab | VM with no public IP, RDP over HTTPS via Bastion | Complete |
| AI-Assisted Alert Triage | Logic Apps + LLM workflow that summarises and prioritises Sentinel incidents | In progress |
Microsoft Sentinel · KQL · Microsoft Defender XDR / Defender for Endpoint · Entra ID · Azure Logic Apps · Log Analytics · Cisco Catalyst 8000 · Firewalls & VPNs · Wireshark · ServiceNow · BMC Remedy · Splunk (familiar)
- Microsoft SC-200: in preparation
- Fortinet NSE 1 · TryHackMe SOC Level 1 & 2 · CCNA training · Google Crash Course on Python
Passing SC-200 and finishing the AI-assisted triage project.