SUMMARY:

• Information Technology Security/Analyst/Architecture experience in large scale systems integration as well as 17 years as a senior security consultant/architect with fortune 500 companies.
• Provides an “experienced practitioner’s perspective” which served as the cornerstone of a complete security/audit function rebuild, as well as the ability to recognize business drivers requiring further reinvention in subsequent years.
• Implemented unique and innovative security approaches including continuous auditing, security forensic/analysis/penetration testing, and various utilities.
• Experienced in applying frameworks and managing every phase of security surges, from requirements gathering, to systems design, development, testing, and integration.
• Have managed development activities and implemented systems based on mainframe, client - server, mobility, cloud-computing and SOA, GRC and web based security architectures.

TECHNICAL SKILLS:

SKILLS: Operating Systems and Networking DOS, UNIX, Win 4.0/20/03, RACF,Server & Workstation, Linux (Redhat), OS 390, AS 400,Mainframe, CISCO, McAfee, Check Point, PIX, RSA, ActivIdentity, Remedy, SSH, LDAP, AD.

Security Tool: ACL, IBM Guardium, Imperva, Qualys, WireShark, MetSploit, AIDE, Nmap,SNORT, Password Has, Hping, ProofPoint, CodeGreen, Duo Security, AlienVault, QRadar, Splunk, Kali Linux, Nessus, Accunetix,NCase, Cyphort, FireEye, BurpSuite, ParosProxy.Gigamon. Fuzzing, VeriCode, CrackMap, GoPhish, Cisco FirePower/StealthWatch, Palo Alto, SCCM, ServiceNow, VeraCode and others.

IAM: Object Security, Tivoli, RES, Oracle Access Manager (OAM), Service Now, SailPoint

CCA’s: SCADA, EMS, PSAS-T, ICS

PLC’s: Cisco 2600, Kentrox 656, Intel 330T, EM316, Kentrox

Databases & Tools: Oracle 8/9i/11i, MS Access, MS SQL Server 7 & 2008, SQL Net, SQL Loader, Instant Monitor, PeopleSoft, SAP ABAP/ECC/GRC, Essbase, Informatica

Programming Languages: C, C++, Java, VB/VB.NET, XML, PL/SQL, Pro*C.

Case Tools: ERWIN, System Architect, Rational Rose.

PROFESSIONAL EXPERIENCE:

Confidential, Los Angeles, CA

Security Professional/Analyst/Architect

Responsibilities:

• Responsible for analyzing, planning, executing, and reporting security testing within SDLC projects and post-production defects. Implemented solutions for SIEM, DLP, AMP, APT, SOC, WAF, Endpoint, IPS, IAM, Two-Factor Authentication, Code Analysis, Encryption, GRC, Cloud etc.
• Performed Pen Testing and Ethical hacking activities on identified tasks and recommended remediation
• Performed Web Application Security Testing and participate in Mobile, Network, Perimeter, WIFI and other security functions as needed.
• Wrote Security Test strategy, Test Cases, Remediation Plan, and Security Test Reports.
• Conducted Dynamic Security Scans, Manual validations/Pen Testing, and other Security QA activates. Conducted Remediation Strategy Discussions and User Review Sessions.
• Lead and Executed efforts with Web Inspect, Burp Suite Pro, Wireshark and other security QA tools as appropriate
• Lead/Participated development of Security roadmap, adopt security best practices, and Implement new ideas and innovations per the industry trends. Created and maintained False Positive Repository Database
• Developed IAM Security roadmap/architecture by conducting technical and requirement analysis.
• Managed security and partner integrations, provided detailed project planning and risk management, and had a strong focus on the agile delivery of products and services into an operationalizing security environment.
• Assisted with configuring Cisco AMP for networks (Firesite/FirePower), Trend Deep Discovery. Implemented security monitoring via NetFlow, Syslog, and full-packet capture
• Developed and implemented security use cases using enterprise security monitoring tools (RSA NetWitness and Cisco StealthWatch
• Maintained and developed security policies, standard operating procedures, and guidelines for security operations, threat, vulnerability and malware mitigation.
• Performed security risk assessment, threat analysis and threat modeling. Perform API (Web Services) security Testing (Restful, SOAP)
• Automated security analysis, administration and remediation procedures, workflows and tasks.
• Maintained awareness of trends in security regulatory, technology, and operational requirements. Ensured and examined third party data security and agreements.
• Participated in business impact analyses for critical business processes, apps and services. Assisted on run-books for applications, infrastructure and services. Experienced in policy, standard and guidelines development.
• Assisted in development recovery strategies and options and assist with the implementation of recovery solutions
• Demonstrated Security QA exercises per industry standard best practices, respective, regulations and compliances. Performed duties of Black hat hackers hat as required and perform invasive security testing.
• Developed internal controls, test steps, process narratives and environment summary of IT infrastructure and applications for (SSAE 16, HIPAA, HITECH, FFIEC, GLBA, CA-1386, SOX, CIP, PCI, CFPB,etc).

Confidential, Los Angeles, CA

Security Professional/Analyst/Program Manager

Responsibilities:

• Performed network security monitoring in order to identify and validate security incidents, reconstruct network activity, and support the incident response lifecycle.
• Experienced in developing cyber security solutions in cloud or hybrid cloud environment Experience with FEDRAMP process Working experience with infrastructure security Working experience with Cloud Service Provider such AWS, OpenStack and Google.
• Planned, Designed and Executed security related artifacts and activities
• Analyzed and responded to security incidents. Designed and Monitored the ongoing optimization of Security Information and Event Management software (SIEM)
• Managed, monitored and supported IT Security technologies/roadmaps, including but not limited to Email SPAM filtering solutions, vulnerability scanning solutions, Intrusion Detection Systems, anti-virus software, Internet web filtering solutions.
• Proficient in manual and automated techniques for penetration testing and executing vulnerability assessments. Ability to analyze vulnerabilities, appropriately characterize threats, and provide remediation advice
• Versed in web application frameworks (Ruby on Rails, J2EE, PHP, ASP.NET), core Internet protocols (e.g. DNS, HTTP, TCP, UDP, TLS, IPSEC) and encryption (symmetric/asymmetric, ECB/CBC operations, AES, etc.
• Development of user awareness training. Identified organizational risk and escalate appropriately.
• Assist in developing and implementing information security compliance policies, standards and procedures. Enforce established Application Security access controls. Review Security Profile changes to ensure private and sensitive data is protected. Coordinated or performed application and security audits.
• Responsible for publishing ongoing security reviews for prospective clients, working with our team to identify security holes, interfacing with our managed hosting provider to secure our environment, testing if all identified vulnerability fixes, and many other activities related to the improved security.
• Derived programs and projects to completion, results-oriented, excellent issue & risk management skills, problem solving skills, multi-tasker, partnering skills, eye for excellence, and communication skills.
• Examined IT infrastructures security (O/S. RACF, AD, LDAP, DB, UNIX, Network, Web Portals, Incident Management, Logical Access, Corporate Security, Change Management and Physical security) and application systems.
• Domain Specific Languages (DSLs) to specify policies SOA (Web Services), these DSLs then should be automatically translated into technical policy rules (e.g. XACML) using policy automation tools.
• Implemented an effective (GRC SAP/Archer/Mobility) environment in areas of IT Management, Information Protection and Privacy, Configuration and Change Management, Policy and Process Management, Enterprise Control Management and Integrated Financial and Compliance Analytics.
• Assisted in developing and executing security strategic implementation plan, worked independently with limited oversight to gather requirements, functional specs, test scenarios, Vulnerability scanner integration and performed testing.
• Expertise in security risk assessment, remediation, reporting and governance, risk and compliance (GRC) methodologies, tools and enablers for various industries.
• Assisted in implemented network and security architecture to ensure overall network development and security of the organization Assets.
• Performed information security evaluation for new projects, delivered reports. Implemented commercial utility security policies and standards. Analyzed Critical Infrastructure Protection requirements for the company’s new smart grid division. Performed security code reviews on Java applications and performed penetration testing and fuzzing of network management applications. Performed security analysis of Echelon and GE smart meters.

Confidential, San Jose, CA

IT Consultant/Analyst/Security Professional

Responsibilities:

• Conduct reviews of PCI/SOX/HIPAA documents and make recommendations for clear and thorough communication of the controls and acceptable control solutions.
• Served as the primary internal information security and compliance consultant to the organization on a day-to-day basis, and examines information security from a cross-organizational viewpoint. Established internal partnerships in a consultative role to provide guidance and help develop processes pertaining to protection of information and regulatory compliance.
• Developed and implements security incident reporting and response to address security breaches, fraud incidents/transactions to respond to policy violations, complaints, etc. Served as organizations contact for information security and IT compliance.
• Monitored the open remediation items and worked with teams on status and communications.
• Interfaced with business teams to gather business requirements and document the product specifications. Effectively identified risks and issues, and formulated solutions.
• Documented uses cases, charters, cost/ROI and functional requirements for various system solution.
• Experienced in PCI Level-1 Assessment work, PCI Remediation consulting, Report of Compliance (ROC) writing and preparing and fraud prevention.
• Served as the primary internal information security and compliance consultant to the organization on a day-to-day basis, and examines information security from a cross-organizational viewpoint Established internal partnerships in a consultative role to provide guidance and help develop processes pertaining to protection of information and regulatory compliance.
• Developed and implements incident reporting and response to address security breaches, fraud incidents/transactions to respond to policy violations, complaints, etc. Served as organizations contact for information security and IT compliance.
• Monitored the open remediation items and worked with teams on status and communications.
• Interfaced with business teams to gather business requirements and document the product specifications. Effectively identified risks and issues, and formulated solutions.
• Conducted reviews of application controls and made recommendations to reduce excessive controls.
• Performed testing of automated of controls for Oracle On Demand and Seibel application.
• Documented automated of controls testing and communicated gaps/findings. Trained finance team on how to test automated controls for different processes and technology.
• Performed segregation of duties analysis for Oracle/Seibel to determine inappropriate/excessive access. Participated in developing roadmap to ensure SOD is automated to ensure high degree of reliability/compliance.
• Assisted in report testing for the finance teams. Examined complex SQL statement for data extraction/filters/etc.
• Interfaced with internal SME’s, E&Y, Internal Audit and others on matters related to compliance/audit.

Confidential, Folsom, CA

IT Consultant/Security/Solutions

Responsibilities:

• Gathered detailed business requirements from teams and created functional requirements document.
• Designed system solutions based on the approved requirements for various project. Worked closely with the IT development teams and Business to identify the best alternative solutions.
• Audited IT infrastructures (Operating Systems, Databases, WEB, Network, and Physical security) and application systems & custom developed applications.
• Audited and designed process surrounding patch management, configuration management, business continuity planning and server hardening.
• Conducted audit testing and analyzed the results in order to reach accurate and appropriate conclusions regarding the design and operating effectiveness of internal controls tested.
• Assisted in remediation process and implementation of strategies. Tracked and submitted assessment findings and recommendations.

Confidential, Denver, CO

Data Modeler/Developer/Security

Responsibilities:

• Created ERD, DFD, Logical model, Physical model and updated as required.
• Maintained Several Client-Server Applications using (ODBC, RDO) using Visual Basic 6.0 to access and modified database.
• Reviewed Data Model, SQL Statements, Stored Procedures (PL/SQL), Views and Triggers for proper index usage. Reverse engineered the current database using Erwin/ERX.
• Created screens with SQL Forms, created views, reports with SQL Reports wrote triggers, created and restored backups. General DBA duties included backups; indexing, security, and disaster recovery plan database maintenance.
• Reviewed and updated Java and VB code when needed for better performance of the system.
• Allowed users to make and cancel reservations by interacting with a GUI calendar object and execute reports developed using Crystal Reports 6.0.
• Based on J2EE application server with Oracle8.0 as the Internet Database, developed thin client using the HTML, XML and XSL.
• The Server side scripting was done in the JSP and Java Beans. The web components accessed the EJB components. The transaction messages from the JSP were sent in the XML format to the EJB components.