Systems SECURITY ENGINEER Resume Profile, NJ - Hire IT People

Summary

Experienced manager and team lead, network security engineer, network security analyst
CISSP-ISSEP, ISSAP 353412
MS in Information Security Engineering from the SANS Technology Institute
Training and experience with ArcSight ESM and Nessus
TS/SCI Clearance with Full Scope Polygraph

EXPERIENCE:

Confidential

Systems SECURITY ENGINEER

Provide engineering and design solutions for security on Federal government networks.
Engineer on project to centralize vulnerability scanning using Tenable Nessus and SecurityCenter.
Engineer on project to create enterprise capability for the security assessment and of source code and code signing. The system uses a variety of tools that include Jenkins, HP Fortify, and HP WebInspect..
Create documentation for compliance with ICD 503 and the NIST Risk Management Framework.
Wrote plans, including configuration management and system maintenance plans.
Led the effort to draft the required controls from NIST SP 800-53.

Confidential

Systems SECURITY ENGINEER

Provided engineering and design solutions for security on the global and enterprise infrastructure of a DoD network.
Served on a DoD contract as the engineer with primary responsibility for the development of the ArcSight security information and event management system SIEM for the Security Operations Center SOC .
Worked with a team to plan the SIEM project, design the architecture of the SIEM, implement it, and structure the flow of logs from devices on the network, including HIDS and NIDS, across security domains into the SIEM.
Named project lead of a team to upgrade Splunk for the SOC. Added several data feeds to meet the SOC's needs. Exceeded the customer's expectations for the timely delivery of data.
Analyzed data from the new feeds to understand how it differed from data the SOC already received. This helped the SOC integrate the new data into their intrusion analysis procedures.
Success stemmed from interaction with managers, engineers, and SOC personnel to meet the goals of the project.

NETWORK SECURITY ENGINEER

Confidential

Provided engineering and analytical support on a task to enhance computer network security CND on a DoD network.
Operations Lead for the security operations center of a DoD network.
Trained Security Analysts on IDS and incident response.
Tool Champion and administrator for Sourcefire IPS and RNA.
Tool Champion and administrator for a PostgreSQL syslog database.
Member of the incident response team.
Monitored the network for misconfigurations and intrusions using Sourcefire IPS events, flow data, and firewall and other logs in PostgreSQL.
Developed other policies and procedures for CND
Developed a procedure for hardening and standardizing RedHat Linux nodes.
Installed and configured OSSEC HIDS.

Computer Network Defense Lead

Confidential

Lead, Computer Network Defense, Network Security Operations and Security Center NOSC
Transformed the NOSC from a unit focused on creating and closing user accounts to one focused on network monitoring and security
Developed the intrusion detection capability of the NOSC
Developed content in ArcSight for analysts
Used Centaur NetFlow data as well the log data in ArcSight for intrusion analysis
Responsible for web and spam filtering using Barracuda
Developed processes and procedures for CND
Developed the team that did vulnerability scanning

security analyst

Confidential

Monitored network traffic on secure and open networks using ArcSight, Sourcefire, McAfee IntruShield, ISS HIDS and NIDS, and several tools developed in-house.
Determined whether alerts from Symantec AntiVirus and McAfee Secure Content Management SCM showed that malicious code was downloaded.
Analyzed potentially malicious files deobfuscated them when necessary.
Analyzed logs of Internet traffic.
Blocked websites in Websense and NetCache.
Write advisories about current vulnerabilities for distribution to IRS technical staff.
Wrote CSIRC Quarterly Reports for 4th quarter 2007, 1st quarter 2008, 2nd quarter 2008.
Delivered CyberSecurity 101 Awareness presentation and ArcSight Lunch and Learn

Confidential

Monitored network traffic on secure and open networks using ArcSight, Envision, McAfee Intrushield IDS, CiscoWorks VPN/Security Management Solution VMS , and Foundstone Enterprise, packet captures, and session data.
Wrote standard operating procedures for Intrusion Detection and Analysis Cell IDAC .
Created Access databases for network wide C A documentation, the project logs, for network devices, and for patches from Microsoft, Cisco, and Sun.