Meera Tamboli
Meera Tamboli is a DFIR Analyst with experience across SOC operations, incident response, and digital forensics within enterprise environments. Her work focuses on investigating real-world incidents, including phishing-driven attacks, credential compromise, and post-exploitation activity, with a strong emphasis on reconstructing attacker behaviour using endpoint, network, and identity telemetry.
She has spoken at cybersecurity conferences and events including BSides (London, Birmingham, Bristol), CSO Summit Manchester, WiCyS US, sharing insights on incident response, phishing techniques and practical DFIR investigations. Her sessions focus on translating real-world security incidents into clear, actionable lessons for both defensive and SOC teams.
She is passionate about making cybersecurity knowledge more accessible and practical. She actively contributes to the security community through content creation (YouTube 40K+ subscribers) and mentoring (500+ individuals mentored).
Session
Modern SOCs are built on mature tooling, automation, and structured response processes, yet incidents still fail to be handled effectively in real environments. The issue is often not technical gaps, but human and operational factors that shape decision-making under pressure.
This talk explores how escalation delays, unclear ownership, cognitive overload, and communication breakdowns influence the outcome of DFIR investigations. It shows how these factors can alter the direction of an incident from the very first SOC alert, especially in phishing-driven intrusions, where speed and clarity are critical.
The focus is on how operational realities, rather than technical limitations, impact incident response accuracy and consistency.