TECHNICAL SKILLS:

Security Skills: Knowledge of Network Security, Web Application Security, IPS/IDS, CheckPoint Firewall, secure protocols (SSH, IPSEC, SSL VPN, SFTP, TSL, HTTPS etc), Hacker Methodologies and Tactics, SQL Injection, OS Command Injection, Cross - Site Request Forgery, Cross-Site Scripting, Incident Response, Host and Network Forensic, Malware Analysis, Penetration Testing, Vulnerability and Risk Assessments, Data Encryption. Experienced with Sysinternals, RegShot, CaptureBat, LordPE, Wireshark, tcpdump, Snort, Nessus, Qualys, Nexpose, Nmap, Burp, Kali Linux, SamuraiWTF, OWASP Mantra and Metasploit

Application Security: Java, Python, x86 Assembly, SQL, C#, HTML 5, Ajax, Web Services, SOA, SOAP, RESTful, Secure Code Review, Threat Modeling

Cloud: Knowledge of IAAS/PAAS/SAAS, AWS(S3, VPC, EC2, Security Group, RDS, ELB, KMS, IAM), Reviewed cloud vendors for security controls

Network & Communications: LAN/WAN, Ethernet, Wireless, ICMP, FTP, HTTP/HTTPS, TCP, UDP, SMTP, LDAP, DNS, WINS, DHCP, VPN

Security Compliance and Standards: NIST, PCI-DSS, CSA, FedRAMP, ISO 27001, OWASP Top 10, SANS Top 25, SANS 20 CIS Critical Controls

PROFESSIONAL EXPERIENCE:

Confidential, Boston, MA

Senior Security Architect/Engineer

Responsibilities:

• Assess cloud (AWS) environments and make recommendations to increase security.
• Define security architecture and solution principles to support business projects.
• Research, design, and develop new information security controls for clients.

Confidential, Washington, DC

Cloud/Application Security Architect

Responsibilities:

• Defined security requirements for new cloud systems in line with the enterprise information security architecture.
• Reviewed security architecture to ensure workloads are secure in various service model (IaaS, PaaS, SasS).
• Provided guidance for data protection based on data sensitivity and associated business risk.

Confidential, Washington, DC

Security Engineer

Responsibilities:

• Preformed Design Reviews, Threat Modeling, and in-depth security penetration testing of Confidential code and systems.
• Designed cloud solution for Confidential products to meet FedRAMP compliance.
• Preformed automated and manual code review of Confidential web and mobile applications.
• Performed security assessments against new applications and systems to detect security vulnerabilities.
• Performed risk assessments and threat modeling to articulate the levels and types of security controls appropriate application/product initiatives.

Confidential, Washington, DC

Information Security Advisor

Responsibilities:

• Provided security architecture and design for Cloud infrastructure.
• Reviewed source code for security vulnerabilities.
• Managed the Threat & Vulnerability Management Program to detect, report, and lead remediation of vulnerabilities systems, networks, and applications
• Performed security risk analysis and approval on changes within Confidential ’s corporate network, cloud infrastructure, and application.
• Implemented security controls to meet PCI standards.

Confidential, Washington, DC

Senior Application Security Specialist

Responsibilities:

• Designed, implemented and performed Third Party security risk assessment against cloud vendors.
• Acted as the security architect to ensure that security was being designed into all aspects of the underlying systems.
• Provided recommendation to resolve application security vulnerabilities.
• Reviewed JAVA, ColdFusion, PHP source code for security vulnerabilities.
• Audited web applications using IBM Rational AppScan, Burp Suite Pro, and a variety of open source security testing tools.
• Performed computer incident response, investigation, and mitigation.

Confidential, Washington, DC

Software Security Tester

Responsibilities:

• Provided guidance to system owners, developers, and architects for FedRamp and FISMA compliance.
• Performed secure code reviews (Web Applications and Thick Client Applications), web penetration testing, and secure SDLC integration.
• Reviewed .NET(C#) source code for security vulnerabilities.
• Reverse engineered applications to detect security vulnerabilities.

Confidential, Washington, DC

Security Engineer

Responsibilities:

• Configured, implemented, and deployed SIEM to monitor security events within AWS and EC2 instance
• Secured and monitored Windows and Linux/Unix operating systems hosted within AWS.
• Assisted in designing and implementing AWS cloud infrastructure to meet FedRamp compliance.
• Performed vulnerability scans using Nmap, Nessus, NetSparker, MBSA and Nikto.
• Performed Network, Systems and Web Application penetration testing.
• Performed security source code review of JAVA and PHP using Fortify and RIPS.
• Performed computer incident response, investigation, and mitigation.

Confidential, Washington, DC

Computer Security Specialist

Responsibilities:

• Assisted with computer incident response, investigation, and mitigation.
• Monitored security events and logs with Trustwave SIEM from McAfee and IBM ISS Proventia (IPS/IDS), CheckPoint firewalls, network devices, Linux/Unix and Windows servers, Windows Desktops, Databases, McAfee anti-virus, and Motorola AirDefense Wireless IDS.
• Performed vulnerability assessment and (web application, servers, network devices) penetration testing, coordinating mitigation efforts with information system owners.
• Assisted with internal security audit on servers, workstations, network devices and web applications.
• Performed network and vulnerability scans using Nmap, Nessus, GFI Languard, MBSA, Nexpose, and Nikto.
• Monitored windows workstations and servers, Unix and Linux servers, and network devices to verify controls were implemented correctly and up to date.