Security Operations Specialist: investigate suspicious login activity