JayodyaMethmal

United States · Remote · Full-time

Leading investigations and response for security incidents across client environments, from first alert to containment and post-incident review.

• Investigate and scope security incidents end-to-end: triage, containment, eradication and recovery.
• Produce evidence-backed incident reports and hardening recommendations for stakeholders.
• Drive detection improvements based on lessons learned from real-world intrusions.

Colombo, Sri Lanka · Full-time

• Monitored and managed Cortex XSIAM operations for the bank's security stack.
• Collaborated with Mandiant on a large-scale Compromise Assessment, deploying forensic artifact collection agents across 9,000+ assets — servers, endpoints, ATMs and CRMs — and supported remediation.
• Acted as the primary incident investigator and responder, and point of contact for the bank's external SOC provider.
• Responded to incidents across the bank's infrastructure, ensuring timely detection, containment and remediation.
• Took part in POCs for Digital Risk Protection and Threat Intelligence platforms, shaping evaluation and adoption decisions.
• Covered an on-call rotation providing continuous 24/7 incident response support.

Colombo, Sri Lanka · Contract

• First line of incident response in a 24/7 SOC — the initial point of acknowledgement for all incidents and customer requests.
• Rapidly triaged alerts for severity and validity, escalating within SLA to the right responders.
• Fed back alert-performance insights — false positives, abnormal patterns, missed detections — to sharpen detection accuracy.
• Kept incident records precise in the ticketing system and ensured critical data sources stayed healthy.
• Produced daily and monthly security reports for customers across on-prem, AWS and Azure estates.

Colombo, Sri Lanka · Internship

• Trained inside a live SOC on monitoring, alert triage and incident escalation workflows — converted to a full analyst role.

Sri Lanka · Internship

• Incident handling with Jira and TOPdesk; security project management in Basecamp.
• AWS security work with Cognito and DynamoDB.
• OSINT-driven social engineering and phishing simulations with Gophish; delivered security awareness training.