Cássio Nakagawa

Hybrid SOC L1/L2 analyst: incident triage and response with Splunk, CrowdStrike, Microsoft Defender and XDR; creation of new detection rules and tool/process tuning with the client's SOC; security awareness sessions for users and training of new SOC analysts. Tools: Sentinel, Splunk, QRadar, CrowdStrike Falcon, Microsoft Defender.

Member of the project implementing a CSIRT and a SOC: incident response processes and documentation, incident investigation, malware and phishing analysis, forensic evidence collection, vulnerability management, SIEM monitoring and detection, threat intelligence integration, pentest coordination and reporting, stakeholder communication. Reduced time from incident registration to first security decision from 18 days to 15 minutes; cut high cloud vulnerabilities by 18%.

IT management and governance (ISO 20000, 27001, 27002); Windows Server and Hyper-V administration; network administration (switches, routers, firewalls); mobile device management (Android/iOS); security operations support, monitoring and incident analysis; LGPD data protection support; security awareness, user training and technical support.