SUMMARY

• Perform application and network penetration tests for global clients
• Use commercial scanning tools such as BurpSuite Pro, Nessus, and other commercial products to analyze systems for vulnerabilities, and provide risk reduction recommendations
• Perform network penetration, web and mobile application testing, source code reviews, threat analysis, wireless network assessments and social engineering assessment
• Performing manual verification of vulnerabilities to reduce false positives
• Creating comprehensive security assessment reports, Risk Metrics
• Interfacing with clients to gather information and investigate security controls
• Work with ICS team to ensure adequate security controls are in place for systems and software in Process Information Networks (PIN) and Process Control Networks(PCN)
• Experience with supporting PLC, DCS, SIS, HMI or SCADA systems and experience in supporting and troubleshooting industrial protocols such as OPC, Modbus TCP
• Experience with ICS, DCS security systems and ICS security industry practices along with exposure to IIoT technologies.
• Skilled Information Security Consultant with expertise in risk management, unauthorized access, malware, wide range of vulnerabilities and threats.
• Well - versed in direct and remote analysis with strong critical thinking, communication and people skills. Able to thrive in fast-paced and challenging environments where accuracy and efficiency matter.

TECHNICAL SKILLS

Security Management: IBM Appscan, Wireshark, Acunetix, nmap, Nessus, Qualys, OWASP Top10

Business Intelligence and Decision Support Systems: Tableau, Power BI, PowerPivot, Power View.

Software Skills: Linux, Penetration Testing, Data Recovery, Virtualization, Hypervisor, ArcGIS

Programming: C, C++, Java, Python, PHP, JavaScript, MySQL, Hive, Spark, Pig

PROFESSIONAL EXPERIENCE

Security Engineer

Confidential

Responsibilities:

• Assessed and reviewed current technology infrastructure to identified key risk areas and ensured a level of control was in place to handle those risks.
• Assisted design and implementation of network simulation environment (sandbox) using tools like NS-3, OPNET.
• Used IBM Rational Appscan, Acunetix, Qualys, w3af for reducing risk by testing web applications prior to deployment and for ongoing risk assessment in production environments
• Development and formulation of specifications for computer programmers to use in coding, testing, and debugging of computer programs and deploying on variety of operating systems (Windows, Linux or UNIX variants).
• Conducted network and server vulnerability assessment scans plus track and report risk mitigation using Nessus OpenVAS, for systems monitoring and operations environment.
• Network visibility and intelligent network gathering of large organizations that run complex networks using tools like ENDACE and ICINGA.
• Through teamwork, conducted security incident investigations; sniffing network traffic for unauthorized network services; reviewed and authorized request for network services such as. Modem lines, ISDN, remote access, VPN, Internet access (ISS Web filtering), and Verisign PKI.
• Maintained, monitored, and upgraded the IDS system and created custom daily reports to alert on anomalous traffic patterns and behaviors, which proved valuable in curtailing the spread of malware and mitigating Worm outbreaks using BRO IDS, Suricata IDS.
• Used Reverse engineering tools to such as IDA Pro, OllyDbg, and Imagix.
• Provide subject matter expertise with regard to applicable regulations such as PCI DSS, NIST-SP800-53, and ISO Risk assessment for best practice throughout all phases of corporate projects.
• Coordinating and supporting the implementation of the response strategies with other parts of the enterprise or constituency, including IT groups and specialists, physical security groups, information security officers (ISOs), business managers, executive managers, public relations, human resources, and legal counsel using Log Analysis, Log Management.
• Conducted risk assessment evaluating security of Web applications and related infrastructure, defining risk matrix, providing technical and executive reports with detailed findings, recommending mitigation strategies and performing cost-benefit analysis
• Conducted Web security related incident responses while supporting investigations of security violations

Network and Security Engineer

Confidential

Responsibilities:

• Implemented and monitored security measures for the protection of computer systems, networks and information.
• Configured VMware environment, Installed and administered Windows Server 2008, which included installing Active Directory, DNS and DHCP.
• Prepared and documented standard operating procedures and protocols, Configured and troubleshot security infrastructure devices.
• Developed technical solutions and new security tools to help mitigate security vulnerabilities and automate repeatable tasks.
• Undertook routine preventative measures of monitoring network security and maintaining network management using NETSCOUT NETWORK SNIFFING and Wireshark. I worked with Windows server 2008 and backed up the company’s server using SUSE Linux Enterprise for server back up.
• Studied security concepts/frameworks such as OWASP, CVE, CVSS, and 0-day exploits.
• Developed security requirements for LAN, WAN, VPN, and DMZ architectures and routers, firewalls, and related network device configurations.
• Knowledge of IDA Pro and Debuggers, Security tools and products, including Fortify, AppScan. Dynamic and static malware analysis, or Windows Operating System Internals, including Kernel, Registry, File system, or Windows APIs
• Setup malware analysis environment for specific threats affecting Windows, Mac OSX, Mobile OS platforms in a lab.

Network and Security Engineer

Confidential

Responsibilities:

• Performed troubleshooting analysis and identified system failures; correlated events to determine point of failure of hardware and/or applications; provided recommendations, oversaw network issues, notified parties of problems resolved in a timely manner.
• Learned IT core functions and applied processes while implementing policies and procedures to safeguard network security system.
• Coordinated work between technicians, engineers and vendors while documenting work actions on network issues until problem was resolved.
• Draft technical manuals, installation manuals, installation progress updates, and incident response plans in order to enhance system security documentation; create required system compliance reports and information requests.
• Performed cross platform audits of Active Directory (AD) objects and user permissions.
• Managed User Accounts on Windows Servers and UNIX Platform (Creation, Deletion, Permissions, and VPN Access).
• Developed organizational units in Active Directory (AD) and managed user security with group policies.