Cybersecurity Analyst LinkedIn Profile Optimisation

I build my security operations around measurable outcomes in Splunk—starting with reliable alert triage, then tightening detections until noise drops and true positives rise. For example, I manage roughly 200 alerts per day by applying correlation logic, validating event context, and documenting decisions with traceable references to log sources. During major incident activity, I track MTTR and use log timelines to confirm containment effectiveness before escalation. This approach keeps investigations repeatable and supports auditability aligned to ISO 27001 control expectations.

My incident response workflow is evidence-led: I preserve relevant logs, capture affected systems, and maintain a clear timeline so the team can make decisions quickly and defensibly. I typically combine SIEM findings with packet-level analysis in Wireshark to confirm how traffic patterns relate to the suspected TTPs. When incidents touch endpoints or suspicious processes, I perform structured EDR/XDR triage to validate behaviour rather than relying on alert names alone. After containment, I verify remediation by checking for persistence indicators and ensuring detections update as required.

I treat vulnerability management as a risk conversation, not a vulnerability list. Using Nessus, I prioritise findings by exploitability signals and business impact, then translate results into remediation actions that developers can implement quickly. For application-layer concerns, I use Burp Suite to reproduce issues, assess real-world impact, and produce clear technical findings that reduce rework. Where appropriate, I align outcomes to CIS control intent and NIST guidance so stakeholders can see both security improvement and compliance progress.

I integrate threat intelligence into day-to-day operations by turning IOCs and TTPs into concrete detection improvements inside the SIEM. Rather than “dropping indicators”, I validate signal quality and tune rules to minimise false positives while keeping coverage for relevant attack paths. I also support governance by mapping evidence to ISO 27001 and NIST expectations, ensuring investigations and changes can be explained during control testing. This includes contributing to access governance discussions (IAM and least privilege) to reduce how quickly attackers can escalate privileges once initial access occurs.