Summary

A career technologist and accomplished Information Technology professional with over fourteen years of experience in Information Security. Deeply skilled in Security Architecture, Risk Management, Incident Response, Security Policies and Regulatory Compliance. Highly effective at understanding and communicating to senior management the impact of security on business and IT operations, and making trade-offs based on risks to the business. Seeking an Information Security leadership opportunity.

Professional Experience

Confidential

Manager, Information Security Services

• Security Architecture: Assisted with architecture, design and implementation of Net IQ Identity Management solution reducing manual invention of account provisioning, help desk tickets and providing faster and accurate provisioning of security access for new practice acquisitions.
• Incident Response: Restructured incident response policy and created incident response plan and procedures to ensure the organization can detect and respond to computer security incidents. Response times to security incidents decreased by 95 and increased root cause identification by 70 .
• Regulatory Compliance: Developed enterprise security strategy and action plan to implement security best practices, comply with regulatory requirements Sarbanes Oxley and the Health Insurance Portability Accountability Act, HIPAA , and implement incident response capability to protect sensitive data and information assets. Developed business case, Profit Loss, and supplemental information for HiTrust assurance program implementation and presented to Information Technology Steering Committee for approval.
• Security Engineering: Assisted with Active Directory redesign to reduce risks of privilege account compromise and protect domain administrator accounts with a privileged account management system.
• Lead initiative to redesign network to improve cyber security and reduce the risk of untrusted internet facing systems being compromised, leading to a data breach or impacting information systems involved in critical business operations.
• Security Management: Changed the strategic direction and vision of the Security Services team. Recruited security engineering talent and mentor junior Security Analysts. Currently managing a team of six Security professionals.
• Vendor Management: Managed third party security consultants, reviewed application and network penetration tests, and delivered security risks and vulnerability findings to business leadership for remediation. Tracked remediation efforts and assist various departments with remediation findings when necessary.
• Security Monitoring: Assisted with successful design and implementation of Q-Radar Security Information Event Management SIEM . Assisted with design and implementation of Fair Warning monitoring solution to reduce the risk of patient privacy breaches, fraud, and regulatory compliance.

Confidential

Senior Information Security Analyst

• Security Architecture: Effectively architected, deployed, and maintained Blue Coat Proxy infrastructure to reduce legal liability, enforce acceptable use policies and track user website usage for the Human Resources Department. Planned, re-designed and migrated the entire security infrastructure to new data center in Culpepper Virginia.
• Security Policies: Developed and implemented patch management policy and procedures which ensures that critical patches are deployed to systems in thirty days from release date, reducing the risk of system compromise.
• Regulatory Compliance: Prepared and successfully executed Payment Card Industry PCI program development, implementation, gap analysis, control testing, remediation, and attainment of compliance initiatives. Highlights include successful design and delivery of Tripwire, RSA Key Management encryption, and Imperva Web Application Firewalls for automated and continuous PCI compliance of cardholder data.
• Vulnerability Management: Implemented and maintained external monthly vulnerability scans through Approved Scanning Vendor ASV for continuous PCI compliance. This includes working with internal application development and IT operations teams in vulnerability identification and prioritizing remediation efforts.
• Vendor Management: Successfully executed the planning, evaluation, selection, and integration of Managed Security Services Provider to outsource Intrusion Detection System IDS and log monitoring of critical systems and which reduced security program costs by 15 .
• Risk Assessments: Developed and conducted Risk Assessments based on a compilation of NIST and other risk methodologies against ILG and its subsidiary companies and information assets. This facilitated a more consistent, comparable, and repeatable approach for selecting and specifying security controls for information systems across the organization. The final report was delivered to Internal Audit and the ILG Board of Directors including Identified risks to the business and recommendations for controls to mitigate risks.

Confidential

Network Security Analyst

• Security Engineering: Successfully implemented Blue Coat proxy infrastructure. Redesigned and maintained Symantec Anti-Virus infrastructure and conducted virus clean up and remediation of servers and workstations.
• Vulnerability Management: Performed vulnerability scanning with Eeye's Retina and Tenable Networks Nessus scanners on Web and infrastructure servers.
• Security Architecture: Deployed Red Hat Linux Enterprise Secure File Transfer Protocol SFTP servers with restricted shell for on board sales and credit card data. Designed Wyse thin client infrastructure, maintained configuration and security of thin clients for Spirit Airlines enterprise.

Confidential

Security Administrator

• Security Engineering: Effectively deployed and managed Checkpoint Secure Platform and Nokia firewalls for wide area network and data center environments.
• Security Monitoring: Deployed and managed centralized security logging using Netforensics Security Information Manager for SOX compliance, event correlation, aggregation, reporting and analysis.
• Patch Management: Architected, managed and maintained BIGFIX infrastructure throughout the enterprise for patch management, software deployment, and asset management of all desktops and servers for TEVA North America.

Confidential

Network Security Engineer

• Security Engineering: Managed Checkpoint, Symantec Raptor, and Netscreen firewalls for internal business groups, external customers and Federal agencies remotely installed and upgraded firewall product offerings on Solaris, Nokia, Netscreen and Cisco platforms.
• Incident Response: Effectively identified, isolated, and assisted with computer system clean up after major virus and worm outbreaks on customer and corporate enterprise networks.

Confidential

Information Security Analyst

Security Management: Performed program management duties for a Federal contract, including day-to-day direct customer contact, project deadlines, and travel assignments. Completed the contract on time and within customer budget. Provide Information Security Certification and Accreditation support for applications, systems and networks in accordance with appropriate customer policies and processes.