(555) 492-8173

Washington, DC

Elena Rostova

Cybersecurity Analyst / Information Security Specialist

Proactive, defense-in-depth Cybersecurity Analyst with 5+ years of hands-on experience in Security Operations Center (SOC) environments, incident response, threat hunting, and vulnerability lifecycle management. Proficient in designing and fine-tuning SIEM/SOAR correlation rules, conducting digital forensics, and aligning enterprise security postures with NIST CSF, ISO 27001, and MITRE ATT&CK frameworks. Proven record of reducing mean time to detect (MTTD) by 48%, mitigating zero-day threats across 12,000+ endpoints, and leading cross-functional incident containment efforts with zero data exfiltration.

Work experience

Senior Cybersecurity Analyst

Aug 2022 - Present

CyberShield Enterprise Solutions

• Arlington, VA

Lead Tier 2/3 incident response and threat investigations across an enterprise infrastructure encompassing 12,000+ multi-cloud and on-premise endpoints. Engineered 65+ custom correlation searches and detection analytics in Splunk ES and Microsoft Sentinel mapped to the MITRE ATT&CK matrix, decreasing alert false positives by 42%. Reduced Mean Time to Detect (MTTD) from 64 minutes to 33 minutes and Mean Time to Respond (MTTR) by 51% via automated playbooks in Cortex XSOAR. Coordinated cross-departmental containment and eradication during a targeted APT spear-phishing incident, securing critical identity providers (Okta, Azure AD) with zero lateral movement or exfiltration. Conducted proactive threat-hunting exercises using endpoint telemetry, detecting and neutralizing persistence mechanisms, living-off-the-land binaries (LOLBins), and credential-dumping attempts. Authored weekly threat intelligence briefings and C-suite post-incident executive summaries detailing root-cause analyses and risk-remediation milestones.

Cybersecurity / SOC Analyst

Jun 2019 - Jul 2022

Vanguard Data Defense

• Washington, DC

Monitored real-time SIEM alerts in a 24/7/365 SOC environment, conducting triage, PCAP packet analysis, and host-level investigation for 150+ incidents per month. Administered vulnerability scans across 4,500 enterprise assets using Tenable Nessus, partnering with infrastructure teams to remediate critical CVEs within strict SLAs. Analyzed suspicious emails, phishing domains, and malicious payloads using sandboxing tools (Any.Run, Hybrid Analysis) and deployed protective YARA and firewall blocklists. Automated daily threat intelligence IOC ingestion feeds into EDR tools using Python scripts, saving 8 analyst hours weekly. Assisted internal security audits to validate compliance with NIST SP 800-53 controls and SOC 2 Type II audit readiness.

Projects

Automated SOC Phishing Triage Pipeline

Jan 2022 - Present

Built an automated end-to-end phishing ingestion and parsing engine that extracts headers, resolves shortened URLs, queries reputation engines via API, and updates perimeter blocklists automatically.

HomeLab Threat Hunting & Detection Engineering

Jan 2022 - Present

Deployed a multi-node Active Directory attack lab configured with Windows Event Forwarding and Sysmon; authored and tested custom detection logic against Atomic Red Team execution techniques.

Skills

Splunk Enterprise SecurityMicrosoft SentinelElastic SIEM / ELK StackIBM QRadarCrowdStrike FalconSentinelOneMicrosoft Defender for EndpointCarbon BlackPalo Alto Cortex XSOARSplunk SOARPythonBashPowerShellRegexTenable NessusQualys VMDRRapid7 InsightVMBurp SuiteWiresharkZeekSuricataSnortTCPdumpCisco ASAPalo Alto FirewallsZero Trust ArchitectureMITRE ATT&CKNIST CSF/SP 800-61ISO 27001SOC 2HIPAAPCI-DSSVolatilityAutopsyFTK ImagerYARAOSINTMalware Triage

Education

Bachelor of Science in Cybersecurity & Information Assurance

Jan 2014 - Dec 2018

University of Maryland Global Campus

Work experience

Senior Cybersecurity Analyst

Cybersecurity / SOC Analyst

Projects

Automated SOC Phishing Triage Pipeline

HomeLab Threat Hunting & Detection Engineering

Skills

Education

Bachelor of Science in Cybersecurity & Information Assurance

Certifications

CompTIA Security+ (Sec+)

CompTIA Cybersecurity Analyst (CySA+)

GIAC Certified Incident Handler (GCIH)

Splunk Core Certified Power User