Maya Chen SOC Analyst
Austin, TX • socanalyst@gmail.com • +1 512-555-0142
Profile Summary
- SOC Analyst with 6 years of experience operating enterprise security operations centers across SaaS, financial services, and managed-security clients, specializing in SIEM-driven detection, EDR investigation, and phishing analysis.
- Hands-on coverage across SIEM platforms (Splunk, Microsoft Sentinel), EDR/XDR (CrowdStrike Falcon, SentinelOne), email security (Proofpoint), SOAR automation (Splunk SOAR), threat intelligence (MISP), and scripting (Python, PowerShell) with strong fundamentals in MITRE ATT&CK mapping, on-call discipline, and audit-ready incident documentation.
- Deep expertise in MITRE ATT&CK-aligned detection coverage, defense-in-depth response, alert-triage discipline, and threat-intel-driven hunting, leveraging methodologies such as follow-the-sun on-call rotations and weekly purple-team exercises to drive fast, well-documented incident response with measurable MTTD and MTTR improvements.
- Engaged collaborator working cross-functionally with Detection Engineering, IT, and Legal teams in NIST CSF-aligned environments, contributing to incident bridges, tabletop exercises, and post-incident reviews with a calm, evidence-first temperament.
- Emerging leader who shares technical excellence and fosters a culture of alert hygiene and postmortem discipline through case reviews and playbook authoring, while leading weekly detection-engineering study sessions and authoring widely used triage and IR templates.
Technical Skills
- SIEM & Log Platforms:
- Splunk, Microsoft Sentinel, IBM QRadar, Google Chronicle, Elastic Security
- EDR & Endpoint Security:
- CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, VMware Carbon Black
- Email Security:
- Proofpoint, Mimecast, Defender for O365, Cofense, KnowBe4
- Threat Intelligence & Hunting:
- MISP, Recorded Future, ThreatConnect, MITRE ATT&CK, OSINT pivoting
- Detection Engineering & Query:
- Sigma, KQL, SPL, YARA, Snort/Suricata, Splunk SOAR, Cortex XSOAR
- Frameworks & Compliance:
- MITRE ATT&CK, NIST CSF, ISO 27001, SOC 2, PCI DSS, NIST 800-61
- Forensics & Network Analysis:
- Volatility, FTK Imager, Autopsy, Wireshark, Zeek, tcpdump, Velociraptor
- Scripting & Automation:
- Python, PowerShell, Bash, REST APIs, Jupyter notebooks
Education
Work Experience
- Owned security monitoring and alert triage across Cloudflare's global edge and corporate environment supporting 3,200+ employees, working 18,000+ alerts per week across SIEM-driven detection, multi-tool alert correlation, and on-call escalation on Splunk and Microsoft Sentinel.
- Drove end-to-end incident investigation for 220+ confirmed incidents spanning endpoints, identity providers, AWS workloads, and edge logs, applying signal correlation across SIEM and EDR, attacker-timeline reconstruction, and scope-and-impact assessment, lifting the true-positive rate from 6% to 22%.
- Ran endpoint detection and response on CrowdStrike Falcon and SentinelOne across 4,500+ endpoints, executing one-click host isolation playbooks, process-tree investigation, and IOC sweep automation, pulling attacker dwell time from 14 hours down to 38 minutes.
- Led detection engineering and rule tuning using Sigma rules for SIEM-agnostic coverage, KQL queries in Microsoft Sentinel, and Splunk correlation searches, authoring 120+ detection rules that cut the false-positive rate from 71% to 18% and lifted MITRE ATT&CK coverage from 41% to 78%.
- Conducted log analysis and first-responder forensics across firewall, DNS, proxy, identity, and cloud audit logs, performing memory acquisition with Volatility, packet analysis in Wireshark and Zeek, and endpoint artifact triage with Velociraptor, root-caused 95+ incidents within the first 48 hours.
- Built threat intelligence enrichment on MISP sourced from MISP, sector ISACs, and commercial vendor feeds, applying IOC enrichment on every alert, ATT&CK TTP mapping for known actors, and threat-actor profile briefings, contextualized 90% of high-severity alerts within 5 minutes of triage.
- Ran phishing and email threat analysis on Proofpoint for 8,000+ user-reported emails per year, working header and routing analysis, URL detonation in Proofpoint TAP, and attachment sandbox triage, cutting the phish click-through rate from 4.1% to 0.6%.
- Operated the incident response and containment program driving endpoint isolation, account disablement in Okta and AD, and IP and domain blocks at the proxy across 60+ SEV1 and SEV2 incidents, compressing mean time to respond from 2.8 hours to 34 minutes within the first year.
- Maintained the team's SOC playbook and runbook library including 45+ incident-response playbooks, alert-triage runbooks per detection class, post-incident reports, and MTTD/MTTR dashboards for leadership, adopted as the SOC standard across 12 client environments.
- Worked closely with client IT, Threat Intelligence, and Legal across 12 client environments to coordinate containment windows, phishing takedown requests, and detection-rule rollouts, tuning 70+ existing detection rules that became the org's triage baseline and onboarding 5 new analysts.