SUMMARY

• 9 years of extensive experience in IT Security Operations, Access and Identity Management IAM, Oracle Identity Management
• OIM10/11g, Audits, Governance, Risk, Compliance - GRC, Investment Banking and NASDAQ OMX Trading Applications and Infrastructure.
• Administrate IAM - Oracle Access and Identity management (OIM10/11g).
• Manage IT security operations, SOX audits, governance and HIPPA compliance.
• IT Security Incident Management and Release Management.
• Security operational Risk ORA, Risk control self-assessments (RCSA).
• Manage Applications, infrastructure, market data systems for SGX Confidential
• System Integration (SIT) and Manual Testing-HP QC,JIRA,OMX test suite
• Project Management and change control Management process (CAB)
• Administrate Trading and operational activities in trade life cycle (TLC)
• Working with Information Risk Management team, manage Confidential Implementation, Configuration and Administration, Production support and monitoring server log, Assist development of the IAM architecture, policies, principles and standards; ensure architecture meets best practices based on industry and organizational needs
• Manage IT Security operations, Access and Identity life cycle, PAM Privileged Access management, Confidential design console, provisioning workflows, DE provisioning, governance, recertification for Investment, Wealth banking.
• Design and implement IT Security policies and frameworks, Internal Controls with MAS - IBTRM (Internet Banking Technology and Risk management) guidelines, administrate Security controls for business applications, systems, workflow creation, business rules and Infrastructure level access.
• Experience in multiple compliances frameworks and regulatory -HIPAA, SOX, ISO 27001, COBIT, ITIL, IT general security controls, automated application and system security controls, privileged access, file integrity monitoring.
• Managed Business continuity management (BCM), Business Continuity Planning / Disaster Recovery (BCP/DR) Documentation, Implementation, Backup and restoration process, Cluster/Node Failover, IDN Networks, Release administrations, Patch, incident and Change management process.
• Application security, Intrusion Detection systems IDS, networks (protocols, ports and packets), performed Sever hardening, Security and Vulnerability Assessment, Penetration and Compliance testing, EMC, BMC, Ethereal sniffer, Nmap, MacAfee and Security level testing, Varonis DatAdvantage tool.
• Manage system Integration projects, project plans, Dynamic data checks, release and change control management for Reuters, handled large full scale projects for SGX Derivatives Quote system, NASADQ OMX Trading environment, liaise with internal departments to ascertain project execution on schedules.
• Expert in Operational Security Risk Assessments (ORA) - Identified threats and vulnerabilities, analyze and evaluated existing controls, performed risk remediation, mitigation and risk rating process, RCA- Risk control Assessments, SSA - security self-Assessment and security testing.
• Manage SSO Projects with Application provisioning/de provisioning, SIEM Security Incident and Event Management BMC tool, DLP - Data Loss Prevention solutions, File integrity monitoring with emc grab.

TECHNICAL SKILLS

Security event Tools: LATTE, ONE Cert, Recertification, SEIM- BMC Patrol, Macafee ESm 9, EMC Grab, MacAfee, Active Directory, Active Role Server, Confidential Java design console, IDM, Access Management IAM, AIM, DLP (Vontu), AD,ADSI, Varonis Data advantage 5.

Testing Tools: HP QC, JIRA, NASDAQ OMX Test suite, Fluke Networks, SQL injection, TTS, Kobra

Database and Tools: MS SQL 2008 server management, Oracle 11g, TOAD 9.7.2, EDA.DMU

Trading Platform: Reuter’s 3000 xtra, KOBRA, RMDS, Ticker Quotes System (TQS), SGX Derivatives Quote Systems, NASDAQ OMX, CLICK XT, Multex.

Ticketing Systems: incident and change - Service Now, ITSM 7.1, Request, eSP, HP OVSD, SR

Performance tools: Vmon, DEC PS, DDC, Skit, Ethereal sniffer, TCPDUMP, Nmap

Process: COBIT 5, ITIL V2/V3, ISMS -ISO 27001/2,ITSMS -ISO 20000, KPI, SDLC, STLC

Project Management Tool: JIRA 5, smart sheet

PROFESSIONAL EXPERIENCE

Sr. Information Security Analyst

Confidential, NY

Responsibilities:

• Coordinates and provides liaison to high level customers for identity management, initiatives and programs such as role management, manage Security Architecture, translate business requirements, customer business issues, opportunities into technical solution, identity and access management to meet business and regulatory needs.
• Support Confidential 10g configuration, administration, Oracle Identity Manager - 11gR1 implementation, ODSEE and OID Connector, UI Customization using oracle APIs, design console, configuration, data migration, data integration / transformation and develop and testing using Oracle Identity -Manager Workflows.
• Liaise with Application owners in defining mapping of roles and entitlements for provisioning, conduct IAM and Role Based Access Controls review for applications, coordinate with stakeholders, requirement gathering, role engineering and develop reports during integration.
• Support business unit customers in mapping employees and other principals to roles and application access, explain access rights and manage process, integrating connectors for various health care applications.
• Provide production daily maintenance and support which includes set ups, corrections, and understanding of integration points, Active Directory & Exchange Configure, provisioning processes, reconciliations tasks.
• Administrate 1199 Healthcare application security, automation, UI configuration, Microsoft Active Directory, Varonis data advantage, data modeling and analysis within a mature access management system.
• Monitor and Administrate JBOSS application server, configurations, logs, execute SQL scripts, database management and data analysis with oracle SQL developer. Work closely with the vendors (Oracle) and internal development teams for various level of testing, facilitate user acceptance testing, test plans, ensure test data available
• Writes reports and perform SQL queries in identity management applications, ON boarding applications, authentications, authorization and identification, measures to detect and ensure correction of security breaches, access and policy violation, provide report on the technical aspects of security management on monthly.
• Manage Information Security, Privacy or Business Continuity,, analyzing complex access requirements against highly-sensitive programs. Assist and advise in the development of the IAM architecture, policies, principles and standards; ensure architecture meets best practices based on industry and organizational needs
• Lead Information Security team in identifying security operational risks, demonstrated IT Risk assessment, develop and drive various risk mitigation/remediation processes, implement security solutions across the health care. Conducts audits or reviews of identity management compliance under direction of Director, Perform IT security audits and monitor internal controls for various applications and infrastructures, Access policies and permissions, provide audit/compliance requirement reports from various applications.
• Liaise with HIPAA regulatory requirement and follow Information Security Frameworks (ISO, ITIL, COBIT and NIST) and ensure it comply with IT Security standards and develop various reports from the IDAM solution and perform Security risk assessments, Risk monitoring and perform risk mitigation process.
• Monitor SIEM- ESM MacAfee reports, administrates Incident ticketing system with ITSM7.1 client application.

Global IT Security Operations

Confidential

Responsibilities:

• Administrate Oracle Identity manager, Design Console, Active Directory, User Identity and privileged access management (PAM), Role and Access Lifecycle Management - RBAC, production and automation issues, Log monitoring and infrastructure security services related to the securing of IT assets,
• Develop IT Security Controls, policies, procedures, processes and operational documents as per the business needs and management directions. Periodically review the minimum baseline security standards, identify the information assets in coordination with business owners, providing an acceptable level of risk mitigation control, RCSA, evaluate Vulnerability and ensure all controls are in place.
• Liaise with Business and IDM development to secure firm's IT applications, review SSA security self-assessments, application and Infrastructure security issues, ensure compliance with IT security policies and standards, analyze the designed controls and fine-tune the IT business continuity and disaster recovery programs.
• Responsible for Oracle Confidential patch release testing, IAM and request releases, validation of security pen test results, problem resolution, system documentation, Compliance and Penetration testing (SQL injection), Report level testing, System Integration (SIT), Functional, Performance, UAT and Ad hoc changes for Applications releases based on Business BRD and Functional requirement documents FRD.
• Lead application security, IT security controls for ON Boarding applications, infrastructures, integrate user accounts with IT security policies, provision and de provision user access, Re-certifications, review information gathered, implement authorization rules, approvals, permission levels to obtain ACL reports.
• Implement workflow creations, user Account/ID, authentications, authorization and identification, session management, data validation, remote logging, server configuration, error handling and log management, managed emerging and existing systems, applications review for SOX compliance, MAS guidelines and IT security standards.
• Manage DLP - Data loss prevention for Devices and emails with VONTU, monitor SOX controls for System, and user privileged accounts, SOD-Segregation of Duties, System level Security, user and functional groups in various platforms like UNIX, Tandem and Mainframe.
• Administrate Logical access management-LAM, ACL, recertification -LATTE, ONE Cert, feed configuration files and database connectivity, ACL Reports for users, systems, Database, Infrastructure Sybase, Share/Functional/user groups, distribution List, logging security and RSA Secure Tokens.
• Administrate IAM business operations process, Active Directory, ARS -Active Role Server, User accounts creation, deletion, Amendments & Work flow, Revoke Privileged Accounts, Access, functional and share groups. Monitor Incident and manage change management process to ensure all Ad-hoc change requests.
• Support BCP activities, manage GIS BAU, ticketing systems - REQUEST, ESP, Service Now, HP OVSC, investigate Security incidents, unauthorized access, system, workflow failures, Reconciliation issues, Password Management, Closure of noncompliance issues. Review and analyze security findings
• Manage RBAC implementation for ON Boarding applications, provisioning access to enterprise applications, business control and non-business applications, monitor & control the overall security components, investigate any security breaches for privilege accounts, Assess potential security problems in request systems, object and process form, rules, workflow creations with Confidential Java Design Console.
• Develop and execute test cases, SQL scripts (TOAD), security level testing to validate data, identify system control and validate system features to meet Business and regulatory requirements, Issue Identifying/ Bug tracking with JIRA, Pre and Post Implementation reviews, manage problem management reports .
• Security Risk Assessments (ORA) - Identify threats and explain the risks associated with common application vulnerabilities (Operational weakness), existing controls, demonstrate exploitation and recommend mitigation options, RCA Risk control Assessments, provide audit reports to Risk Committee.
• Liaise with External Auditors PWC MAS, KPMG, SOX, RBI inspection, BIA audits, perform audit engagements, including identifying and assessing Risk and mitigation process, Risk control testing, Audit trail, control issues, regulators and security compliance requirements,
• Managed SSO projects - user Identification, provisioning IT resources and operated in accordance with applicable security standards, proactively improve the application data integrity, serviceability, reliability and scalability.

Sr. System Analyst

Confidential

Responsibilities:

• Implements information security policies on Core Trading Systems, Applications, Infrastructure and User level accounts and access, IT Audits and SGX IT security checklist, perform Risk assessments - Identify, Analyze and Evaluate risks and business impacts.
• Administrate Active directory AD, System configuration setting, IT security and Server access policies for Authentication, Session management, Access controls and permissible values for Trading Applications, users, Systems, flow of information throughout the Application, DLP - protection of sensitive data, Network configurations and gateways, Vulnerability assessments, Oracle RDB Database functionality with SQL injection, Production and Disaster recovery process, remote FTP and policy.
• Liaise with SGX IT Governing Council, Implement IT Security controls, Audit trail, Penetration testing and Compliance checks for Core Back office trading Systems, Applications, Infrastructure Access privileges, administrate system file permissions, Network configurations and Connectivity, Database access and protections, configurations files checks, batch Jobs, Feed connections, root cause analysis
• Conducted Security reviews and developed mitigation plans, perform technical testing using scanning and vulnerability assessment tools, Response to security incidents, Identify threats and risks, ensuring confidentiality, integrity and availability of all system and application data, Security level testing like vulnerability assessments and scanning, Penetration (SQL injection) and compliance testing, OS hardening, Functionality, Latency, IWT, Regression, DR Testing, Market Data Validating.
• Administrate user Accounts/ID, monitor privileged accounts, Access controls for Internal/External gateways, ILO cluster administrations access, Data center access and SAN access and connectivity testing.
• Identify security regulatory requirements, requirements for applications, services and supporting infrastructure and effectively communicate requirements to application development teams and business owners, review and improve IT policies, standards and manage reports.
• Lead Application Security, administrate Security and Access controls, permissions, to meet requirement of regulations, potential incident investigations and audit trials, Server hardening, DLP for devices CD,USB network drives, Log information transmission, monitoring Log storage, Log analysis and Log disposals.
• Log and Event management SIEM- BMC console, support BAU activities, Trading application issues, Core Trading systems process and health checks, Database Oracle RDB, Log Management, batch jobs, Incident tickets and issues, real-time monitoring of processes, connections & trade flows, Trade floor, L2, Client -Server access connectivity, server hardening, systems and user level connections,
• Perform and developed BCP documents, Implement disaster Recovery process, design and execute test cases, test experience in work area recovery (WAR), BCP Simulation, test planning, scheduling, defect management process (HP Quality center).Review Requirement specifications, Release administration and Patch Management.
• Liaise with the Business Analysts (BA) and Development team for requirement gathering for client issues, Administrate NASDAQ OMX Releases, RR, WO planning, rollout, Incident alerts from command centers, Support pre CAB meetings, Change management process, Ad-hoc changes in Operations, RFC’s and CR.
• Engaged with SGX Derivatives Quote systems (QUEST-DT) projects - Managed OMX- Genium market data systems for Secure Clearing and positioning, Settlement, Risk Evaluation, Margining Systems, Click - Market Orders, Dissemination and Deal Capture trading systems.
• Manage large scale SGX clear project, Build, Integrate, test and Implement Nasdaq OMX Market data systems, trading Clusters, Click XT, Integrate OMX Applications and Infrastructures, setup trading platforms, monitored SGX managed networks, DMDF market data systems, OMnet process, API, CLICK XT via OMX open API TRADE platform, Application management with APPSMIND and BMC PATROL
• Install/Upgrade/configure/Test and troubleshoot Servers - HP Integrity Blade ITANIUM, ALPHA and Windows severs, BMC PATROL configuration, AMT, HP RTR (transaction router) for Data Transactions and Testing IP Networks and Data connectivity for SAN EMC systems.

Senior System Integration Engineer

Confidential

Responsibilities:

• Reported to Market Data Collection Development Head - APAC, Market Data Integration projects, Implement Application and system Security controls Compliance check with Reuters Security policies, integrated with setup Infrastructure, Application deployment, VAP and network feed connectivity.
• Manage Reuters 3000 xtra, KOBRA trading applications, Market Data Integration Projects, Direct Integrates seamlessly with Reuters Data Feeds and Reuters Market Data System (RMDS), Identify the flow of market data through the Reuters Market Data System from Stock Exchange to Client, Market Data Validation as BAU, develop and implement Access Levels to Trading Applications
• Lead In-house system integration projects and application Release deployments for the Reuter Instrument Code (RIC, SIC), Enhancement and service improvement projects, Implementation and monitoring for Market Data flows, Application and OS hardening, software development process on projects through the entire SDLC as a value-added activity implement and enforce all processes and procedures as per standard.
• Build, Test and Implement the IDN network- Infrastructure, Applications and Feed RDF-D, Support market data real time issues, L2 support, Log management and Change control procedures for roll out from development to production, process and procedure documentation and fixing bugs as per incident tickets.
• Monitored Reuters IDN, OCM operational control monitor, real-time monitoring of processes, connections & trade flows, system failure, operations and exchange/venues, Identify, troubleshoot and respond to emergency situations impacting traders or exchanges, Reconcile trades and position breaks, liaise with application owners and System Administrators to assist with forecasting system utilization.
• Managed Confidential system integration project team - Beijing, lead integration projects, progress reporting, configured HP Servers, Application hardening, vulnerability scanning, penetration testing, compliance checks, VPN configuration, end to end latency testing and IT Security Audits.
• System Integration testing (SIT) for Trading and back office applications, EQUITY valuations, QA Testing for System and trading application levels (End to End), Data Feed connectivity, UAT, Functional, Performance, Integration, Regression, Load, Stress, Progress Reporting, including test case results.
• Lead Market data integration projects like Infrastructure up gradation and migration projects, Ticker Quotes systems, Integrated Digital Network and VAP up gradations, Settlements and Clearing financial instruments and service enhancements. Managed Reuters Tick Capture Engine enhancement projects, RTCE are fully integrated with Reuter’s data (DFC, DFR, DFH, Tick History and Corporate Actions) and Reuters Market Data System (RMDS), ILS – Intelligence Line switching.
• Managed Day-to-day Market Data Operations & System Performance, Monitoring for Data flow, Network capacity, Bandwidth utilization, Network Latency, CPU and Memory Utilization, Server health, Identify Severe incidents/recurring problems. Testing on Data base for Operations.
• Design and develop Manual or automated script for testing, execute test cases in HP QC, Defect tracking and data validation, follow up issues identified, bug tracking and fixing, Resolution of incidents or problems, Requests to upgrade services, Implementation of new services
• Manage Release administration, planning, documents, co-ordination/support different team during Implement the releases, prioritization, compliance for process adherence, Patch and Global Change management process – Ad hoc change tickets, RFC’s, CR, SCM, and pre CAB meetings
• Implement new data processing methods, tools, and techniques that can improve customer quality and productivity, contribute to continuous improvement efforts, Test new programs, tools, and techniques for acceptability, usability, and performance as documented; make recommendations as necessary.

Engineer Order Management

Confidential

Responsibilities:

• System Analyst for Global Network Operations, Application testing, network connectivity for Data migration, Integration Projects, Manage Data feed connections, Data validation and reports generations.
• Design and develop Operational procedure, Solution Implementation order desk SIOD for Cable and Wireless UK. TCP/IP PROTOCOLS, Installation, configuration, troubleshooting, Implementations and monitoring and tracking SLA for all Global client Issues and provide remote technical support.
• Global Network data Operations, Troubleshooting, Integration Testing Back office network, applications, QA status reports in all phases, Data like IPVPN, Switched, IPLC, Leased line and Bug Tracking,
• Support the Ticketing systems, incident Tickets, Service Request for day to day Networks Operations issues, Data feed connection, including escalation and communications of all outages, provisioning of new service, Cessation of services for the various products and implement Security Compliance.
• Liaise with the Development team, Support Release management, raise CRF (change request form) for production and Testing environment for both Infrastructure and software applications.
• Managed security implementation of core trading CTCL VLAN in catalyst switch CISCO3550 layer3
• Managed NOC, network switches, Access control for trading systems, providing L2 and trade floor support, Incident tickets and systems, infrastructure and application testing, TCP IP/Protocols and VPN
• Administrated LAN, WAN, VSAT, Leased Line, TCP/IP, UDP, ISDN, VPN, VLAN, Troubleshoot Hub/Router CICSO 2900, 3550 switches, UAT and database Testing, client and server connections, Support production activities, monitoring System health checks, Network traffic and interface’s.
• Responsible Network data operation activities, configuration, systems NOC, providing access to remote login for various clients, file management (uploading/Downloading) from multiple sites. Troubleshooting the Internal/external network problems as per operational procedures and batch jobs.
• Performed Vulnerability scanning and packet/protocol/Port analyzer, network traffic with Ethereal Sniffer interfaces, capacity monitoring and installation, support trading server administration, data operation, backup and restoring, UAT and data validations.
• Handled network administration, installation, troubleshooting of Cisco Switches, Routers (1800, 800), configure protocols TCP/IP, UDP, Client-server / Application release implementations (both pre and post).
• Manage network operations, support 24x7 for LAN, WAN, leased line, VPN - (Site to site and Remote site), Servers, Network topologies and upgrading projects, desktop and client related issues, backup solution & policies, restore and proactive approach to managing disk space.
• Design, develop test data, scripts, execution tests, defect management, UAT testing, system, application, conformance, penetration and Release management – rollout for software releases.