PROFILE

Extensive experience includes: Senior network security consultant with over 14 years of experience in digital security, drawing on experience from fortune 500, public utilities, major telecommunications providers to local and federal government clientele Specialist in penetration testing and vulnerability assessments Expertise in assessing web and database application security Information security advisor helping clients define and build InfoSec organizations, including the charter, strategy, governance and operations. Direct experience with communicating with C-Suite at Fortune 500 as well as IT Engineers and Network Administrators Incident response specialist with experience in post-breach forensics analysis Expertise in Compliance Standards PCI DSS, NERC/FERC, ISO/IEC 27001, HIPAA, etc. In depth experience in implementing global SIEM solutions Security Incident Event Management , including escalation, policy and traffic analysis, in multi-tiered enterprise environments Extensive experience dealing with ISO, NIST, OWASP, ITIL COBIT standards

TECHNICAL SKILLS

Attack Penetration In depth experience with internal, external, network, application vulnerability assessments of web, windows and UNIX systems using local and remote exploits including: web-based application attacks, privilege escalation, network protocol attacks, buffer/heap overflows, 802.11 wireless attacks, SQL database attacks, stealth attacks, replay attacks, connection hijacking, spoofing, root kits and password cracking. Extensive experience using various penetration testing applications, sniffers, and vulnerability scanners. Infrastructure Security Detailed knowledge of TCP/IP, IEEE 802.11, wireless, routing protocols, secure networking design and analysis, with emphasis on host and application hardening for web servers, mail servers, firewalls, authentication servers, Intrusion Detection/Prevention Systems IDS/IPS , Active Directory, DNS, and Virtual Private Networks VPNs Intrusion Detection Systems Experience implementing various commercial and freeware IDS/IPS systems on Windows and Unix platforms TippingPoint, Snort, Suricata, Enterasys, McAfee Intrushield . SIEM Extensive experience in distributed enterprise deployments of the following products: AccelOps, Splunk, QRadar, etc. Operating Systems Detailed understanding of Microsoft Windows, FreeBSD, OpenBSD, Linux Red Hat, Debian, etc , Oracle Solaris, Novell Netware. Security Tools Scanners: Rapid 7 nExPose, nCircle, Nessus, w3af, Burp Proxy, Sqlmap, nmap, nipper, Web Inspect, Whisker, Hping, Metasploit, Social Engineering Toolkit, Backtrack Suite Sniffers: Wireshark, Tcpdump, Snort, Dsniff, Aircrack-NG/Airodump-NG suite, Kismet Forensics: FTK Forensic Took Kit , Encase, Autopsy Browser, LSOF, Fport, Undelete Host-Based Security Tools: Tripwire, OSSEC, Snare, MD5 Checksum utilities, chroot, tcpwrappers, SELinux, St. Jude LIDS Firewalls: Check Point, Cisco ASA, Juniper, Fortinet, PF, netfilter/iptables Cryptographic Applications: PGP, OpenSSH/SSH, OpenSSL/SSL, Apache SSL Mod SSL Scripting/Languages: Proficiency in Python Shell Scripting

PROFESSIONAL EXPERIENCE

Confidential Position: Partner/Principal

Consultant Botnet DDoS Remediation/Whitelisting Perimeter Security Controls APT/Malware Analysis DDoS Remediation NERC/FERC Auditing, Self-Certification, Penetration Security Risk Management Services Client was largest West Coast Utilities Municipality PCI Compliance Audit Risk Management Framework Creation Vendor liaison in a multi-partnered network: Assisted with business unit acquisition integration while ensuring PCI compliance. Designed roadmaps and remediation plans for several Level 1 and Level 2 companies striving for PCI Implemented SIEM and IDS/IPS systems as well as security logging solutions HIPAA Audit Controls Remediation Splunk, QRadar, Accelops SIEM Deployment s in multinational enterprise environments Provided formalized training for the following: o Vulnerability Assessment Methodology o IPS o SIEM Deployments Performed web-based application and network vulnerability assessments for several high-profile clients, locally and internationally Performed Targeted Spear Phishing Whaling Attacks as part of penetration testing engagements Confidential Position: Senior Security Architect Security Infrastructure Services Attack and Penetration Testing/ Risk Assessment s Application Security Assessments HIPAA SOX Consulting Confidential Position: Senior Network Security Consultant Attack Penetration Testing ISO/IEC 27001 Enterprise Audit s Enterprise Policies Procedures Framework Enterprise-wide rollout of IPS Confidential Position: Network Security Consultant Subject Matter Expert: InfoSec Developed approach and methodology for several professional services Performed vulnerability assessment and penetration tests HIPAA Audit Certification/Remediation Controls Business-to-Business VPN deployments in multi-site environment Confidential Position: Lead Systems Engineer Multiple Vulnerability Assessments/Penetration Testing Engagements Multiple Enterprise Installations of Checkpoint Firewall-1 VRRP for Nokia IP 650/ 440 Stone Beat High Availability Cisco PIX Confidential Position: Network Consultant Designed corporate Security Policy and Procedures, Business Continuity Plans, and Security Infrastructure for primarily large scale corporate, educational, and medical networks Developed security architecture at three data centers Designed multi-layered disaster recovery and escalation plan CEH EC-Council Certified Ethical Hacker IASO Department of Defense Information Assurance Security Officer NSA IAM National Security Agency Information Assessment Methodology CISSP ISC2 Certified Information System Security Professional Sans GSEC SANS Security Essentials CCSE Checkpoint Certified Security Expert CCSA Checkpoint Certified Security Administrator NSA Nokia Security Administrator Cisco Security Specialist I CCNP Security Track Oracle 9i Certified Associate CCDA Cisco Certified Design Associate CCNA Cisco Certified Network Associate BCMSN CCNP Track-Building Cisco Multi-Switched Networks MCSE Microsoft Certified Systems Engineer MCP Exchange 5.5 MCP Proxy Server 2.0 CNE Certified Novell Engineer