PROFESSIONAL EXPERIENCE:

• United HealthCare/ Optum Technology
• Lead Counter Threat Unit Analyst
• Acquire, process, analyze and report on forensic images with Encase, FTK, ProDiscover, Autopsy, SIFT,DEFT
• Develop SIEM content for RSA Security Analytics for Investigators and SOC Analyst
• Train and mentor counter threat investigators
• Prove incidents of compromise, supporting 225,000 endpoints
• Train SOC on investigations
• Malware analysis, reverse analysis
• Build process flows and document operations
• Work with FireEye, Damballa, SEP, Palo Alto, Checkpoint, Cisco ASA, F5 ASM to manage event
• Search for Indicators of Compromise and work war rooms to respond and manage to incidents
• Logging data to HADOOP and querying threat intelligence platforms
• Feed data to threat intelligence providers
• Work with acquired entities and external business partners to resolve Cyber Incidents
• Dominion Power and Light

Work Experiences

Confidential

Arcsight Content Developer

• Develop advanced SIEM content to detect policy violations and data breaches
• Built Threat Intelligence and Information capabilities using STIX, CYBOX, TAXII
• Deploy SSL decryption technologies in proxy or pass thru mode
• Manage breach investigations, work with internal and external teams
• Baseline network and security incidents and build advanced correlation rules
• Map out business data flows and establish patterns of interest
• Train Dominion Cyber investigators
• Develop threat management actions to reduce attack surface and mitigate risk
• Malware Analysis

Confidential

Vice President Information Security

• Manage and maintain PCI Compliance for Level 1 for Payment Processor
• Manage and Maintain TR-39 Compliance
• Develop and implement business continuity program
• Document daily operations
• Direct investigation and manage incidents
• Develop Imperva WAF policies
• Develop Q1 Radar SIEM content
• Review and investigate compromised devices

Confidential

Cyber Security Architecture

• Extensive work with Arcsight, Q1, RSA Security Analytics, Alien Vault, Splunk, LogRhytm with 15k-300k EPS
• Working in client environments ranging from 5k-250k end users and 5k-40k cross platform servers
• Develop advanced SIEM content to detect policy violations and data breaches
• Built Threat Intelligence and Information sharing platforms using STIX, CYBOX, TAXII
• Deploy and manage multiple global sensors to collect threat intelligence
• Deploy and manage deep packet engines like RSA Netwitness, Solera networks, Silent runner
• Deploy, use and manage case management tools
• Deploy Vontu, Mcafee, RSA Data Loss Prevention systems, develop DLP policies and SIEM content
• Deploy SSL decryption technologies in proxy or pass thru mode
• Manage breach investigations, work with internal and external legal support teams and law enforcement
• Perform forensic imaging of laptops, desktops, servers, phones, tablets and produce report of findings
• Perform memory and image analysis to identify malware, malicious code
• Review and negotiate legal contracts, develop corporate policy, standards and procedures
• Develop security architectures, project plans and implementation plans for global technology deployments
• Deploy Malware platforms and repositories such as VxCage, Maltrieve, Cuckoo, FireEye, Bromium, Damballa, Lastline, Cyvera, Cuckoo, Invincea and Trusteer
• Deploy Endpoint solutions such as Symantec or McAfee ePo for antivirus, endpoint encryption, DLP
• Deploy Imperva, F5 ASM Web application firewalls and database activity monitoring solutions
• Deploy Network Access Control NAC Forescout/Cisco/Aruba to manage guest networks and rogue connections
• Manage PCI, SOX, HIPAA, FTC, GLBA, NERC CIP compliance mandates, gather evidence and maintain compliance
• Develop and implement enterprise vulnerability management solutions with solutions Ncricle, Qualsys
• Develop CSIRT programs to detect and manage global incidents
• Deploy and tune IPS solutions such as Palo Alto, Sourcefire, Tipping point, IBM Proventia
• Deploy other security controls such as Bit 9, Tripwire as mitigating controls as identified during risk assessment
• Develop network architectures and migrate routing protocols, re-architect DMZ networks, core networks and perform migrations to Cisco Nexus and Cisco UCS platforms
• Build network zoning and defense in depth security architectures
• Perform packet level inspection by tapping networks and utilize tools such as Gigastor, Sniffer, Wireshark, Airshark, Airdefense, Netscout, LanCope to troubleshoot network issues or support forensic investigations.
• Build application performance monitoring to identify slow-downs and service outages
• Develop and deliver detailed flow diagrams, develop operational procedures, policies, risk analysis, gap analysis
• Program manage the enterprise to develop, test and implement business continuity plans
• Build out security operations centers,
• Trained onshore, offshore staff, develop career progression plan and mentor staff
• Perform daily CyberSecurity investigations, hands on with tools and processes
• Built custom logging, data mining and monitoring solution based on HADOOP
• Perform Pentesting and Application security scanning and analysis for diverse client base
• Acquire, process and report on forensic images with Encase, FTK, ProDiscover, Gargoyle, Autopsy, SIFT,DEFT
• Deploy Threat Management program to identify incident trends, control failures and high risk events to remediate

Confidential

Security Architect

• Educate and mentor permanent and contract staff on GRC compliance program objectives
• Develop and deliver implementation project plans for global technology deployments
• Develop and deliver risk impact statements, risk assessments and report of findings
• Develop and deploy security controls to meet PCI compliance mandate
• Deploy proxy solutions globally Bluecoat, ISA 2006 , Deploy and manage Kazeon e-discovery solution
• Architect and deploy IBM Proventia Intrusion Preventionappliances globally
• Perform data flow mapping to identify regulated data flows
• Deploy Data Loss Prevention solution to monitor use of sensitive data, Perform E-discovery and legal holds
• Perform incident response Investigations based on RSA Envision SIEM use cases
• Architect and deploy secure file transfer solutions
• Virtualize systems with VMware, performed P2V, Vshield Configurations
• Global firewall migrations on Cisco, Checkpoint and Nokia Appliances
• Network architecture design, troubleshooting and deployment
• Policy, standards and procedure development, train and mentor staff on compliance requirements
• Produce technical Visio documents containing security and network infrastructure diagrams
• Deploy optical Confidential solutions for high availability networks.
• Application Penetration testing and Source Code Analysis Ounce Labs, Fortify, Web Inspect
• Perform GRC activities in risk management and compliance group
• Deploy and configure Cisco routers, switches, Nexus based switches, MDS platforms, firewalls, Cisco load balancers, troubleshooting layer 2,3 and routing protocols

Confidential

Security

• Develop policy, procedure and technical controls to move forward security project within the Confidential
• Deploy open source SIEM for event correlation
• Deploy security controls such as IPS, Firewalls, RSA two factor authentication

Confidential

Information Assurance Network Engineer Manager

• Worked closely with senior military leadership for all GRC efforts inMiddle East theatre of operation
• Weekly briefings to military commanders
• Lead team of Information Assurance IA network security engineers at diverse locations throughout middle east
• Worked with IA managers to become compliant with DISA security standardsand STIG's
• Developed detailed documentation and performed security testing for Confidential certification accreditation
• Deployed and supported all ASA, PIX, Sidewinder and Symantec firewalls in IRAQ, Afghanistan and Kuwait
• Troubleshoot routers, switches, routing protocols, load balancers, VOIP and LAN/WAN circuits consisting of Frame relay, SONET, MPLS, ISDN, Troubleshoot VPN, QOS, Routing Protocols such as OSPF, EIGRP, BGP and Multicast networks
• Deploy Cisco routers, switches, firewalls, content switches, Vbrick multicasting solutions in a 220,000 user endpoint multi country WAN infrastructure
• Support IDS appliances and work with Confidential onArcsight SIEM events
• Security monitoring on MNC, NIPR and SIPR classified networks

Confidential

Program Manager

• Develop agency HIPAA security program and gained executive acceptance
• First State agency to become compliant with HIPAA security mandates for State of CT
• Deploy wireless network statewide to achieve cost savings by eliminating point to point circuits
• Business continuity program for continued care for Statehospitals in the event of a declared disaster
• Deployed centralized HIDS, NAC and Antivirus management solution to reduce virus infections and security incidents by 95 , freeing up two FTE's for other project work
• Performed Malware identification, analysis and remediation
• Implemented patching and vulnerability process
• Configured, deployed and supported Cisco routers and switches for wired and wireless networks statewide
• Deployed identity management and single sign-on solution
• Monitored State networks with ISS Siteprotector IDS System
• Deployed, configured and supported McAfee EPO HIDS agents for agency
• Train and mentor agency staff
• Developed operational manuals, procedures and response plans

Confidential

Principal Consultant

• Trained and educated hospital executive management on HIPAA compliance mandates
• Project management, security strategy development, perform assessments, gap analysis and remediation
• Developed and deployed technical and procedural controls, Develop security and network architectures
• Troubleshoot networks and systems, Deploy single sign on solutions and identity management
• Deploy Dragon and SNORT IDS system, Web application security testing using Cenzic for regulated systems
• Implemented vulnerability management program
• Support client during network outages to resolve complex routing or network issues

Confidential

Chief Technology Officer

• Worked closely with the CEO and CFO to overcome funding challenges for Internet startup
• Designed and implementing Internet data center, develop and implement network infrastructure design
• Worked closely with contractors to build out and commission datacenter
• Developed company security, network strategy and drove budget process
• Implemented security strategy to insure zero security incidents for hosted customer environments
• Maintained VOIP hosted solution, Developed and managed Incident response program
• Design and deploy LAN/WAN/MPLS networks, Troubleshoot routing protocols BGP, OSPF, RIP, EIGRP , deploy routers, switches, load balancers, security appliances
• Deploy and support IDS/IPS solutions, mitigate DDOS attacks, Deploy PIX, ASA, Sidewinder,Checkpoint and Smoothwall firewalls. Support servers and Operating systems
• Configure reverse proxies, Load balancers, 3rd level support for hosted client solutions
• DeploySIEM platform for event correlation and logging
• Deploy application and networking monitoring
• Managed 24 indirect reports, 3 direct reports
• Develop Physical Security program for secure data center
• Develop CSOC, NOC and CSIRT capabilities and manage daily events