OBJECTIVE

Seasoned and passionate Information Technology/Information Security professional with over 13 years experience, seeking a challenging position with a company that will fully utilize my vocational experiences and expertise.

PROFESSIONAL EXPERIENCE

confidential

Information Security Analyst

• Create and update policies, standards and procedures
• Key participant in developing draft Risk Management framework
• Successfully install, configure and maintain information security tools and enterprise appliances: Tripwire Enterprise Server
• Tenable Security Center
• ScriptLogic Active Administrator, File System Auditor, and Enterprise Security Reporter Safend Protector
• Cisco IronPort Email Security Gateway
• Use Tripwire Enterprise Server for agency Change Management and Incident Response processes Use Tenable Security Center for agency Vulnerability Assessment processes
• Use Safend Protector for agency Data Loss Prevention DLP processes
• Determine security violations and inefficiencies by conducting periodic audits on various areas of the agency's IT infrastructure. Lead audit and compliance assessments for:
• Active Directory - DNS, group policy objects, user account and workstation/server configurations, file/folder permissions, startup scripts, sites and services
• Routers, Switches and Firewalls Mainframe/CA Top Secret
• CA TopSecret mainframe security administrator
• Perform WebSense administration and monitoring Conduct periodic entitlement re-certifications
• Assist in network and server troubleshooting
• Perform log monitoring and management duties
• Major contributor in implementing an Information Security Management Program based on the ISO 27000 framework and some NIST
• Major contributor in developing and implementing a Bring Your Own Device BYOD solution/program based on agency business requirements.
• Security Operations Manager
• Successfully develop, implement and maintain Vulnerability Management program Conduct Penetration Testing
• Use risk management processes to aid in decision-making and selecting appropriate security controls Create project plans modeled after a basic System Development Life Cycle SDLC methodology
• Create baseline configurations for IT infrastructure devices
• Monitor Information Security controls and ensure their proper implementation Monitor changes in business, technology, and threat environments
• Evaluate new products and technologies to meet business requirements
• Assist in developing and implementing agency-wide security awareness program Backup to the Chief Information Security Officer CISO

confidential

Information Systems Manager Housing Division

Server Manager:

• Managed and maintained Novell Netware 5.1, 6, and 6.5 servers
• Configured/implemented, managed and maintained Windows 2003 and 2008 servers, Active Directory, DNS, DHCP, Group Policies and Windows Software Update Services
• Managed Symantec Antivirus Corporate and Symantec Endpoint Protection on Active Directory and Workgroup
• networks
• Managed VERITAS/Symantec Backup Exec for tape backups

Network Engineer:

• Configured/implemented and managed Cisco routers and Frame relay networks, and Cisco Catalyst and HP
• ProCurve switches
• Setup and managed wired and secure wireless local area networks at over 25 remote locations Troubleshoot MPLS networking and firewall configuration issues

Security Administration and Engineering:

• Created and updated policies, standards and procedures Performed log monitoring
• Recommended and implemented various administrative, physical and technical security controls
• Used NIST, CIS and Microsoft Hardening Guides to create baseline security configurations for workstations, servers and network devices
• Performed vulnerability management activities to discover, assess and report risks/vulnerabilities associated with user workstations, servers and network devices
• Used various penetration testing and vulnerability assessment tools including Nmap, Nessus, Netcat, Cain and Able, John the Ripper, NSLookup,VNC, Ethereal/Wireshark, NetStumbler, Kismet, and many other utilities and scripts for penetration testing/vulnerability assments and IT functions
• Used Wireshark to identify computers infected with worms on the network
• Investigated and reported, policy violations, malicious employee behavior and malware activity

Project Manager:

• Managed multiple high-priority projects simultaneously
• Identified cost savings in different technologies and venders develop/maintain vender relationships Prepared RFPs and manage bid processes for large equipment purchases

Telecommunication / Phone Systems Management:

• PBX and VoIP System management
• Performed system maintenance, and user account adds, removes and changes
• Managed Verizon Centrex Lines and administered Nextel Phones and Address Books

Help Desk Manager:

• Configured and managed Outlook, and GtoupWise E-mail Clients
• Upgraded and setup of PC hardware and software Windows 2000, XP, Vista, and Windows 7
• Provided support for more than 400 users in multiple computing environments ranging from Windows 2000 to Windows 7
• Provided user training
• Maintained inventory for software and hardware workstations, servers, and network devices Managed Citrix Metaframe client connections and software

confidential

Information Security Engineer

Technical writer:

• Developed Test Plans for multiple Security Test and Evaluation engagements
• Compiled multiple Security Test and Evaluation reports detailing the total testing process and test results
• Recommended administrative, technical and physical controls to improve the security and/or performance of the organization, technology and/or processes
• Created various status reports detailing the progress of projects, audits, and tests

Data Center and Application testing for large government client:

• Conducted interviews and documentation reviews for various Security Test and Evaluation engagements
• Performed internal penetration testing across local and wide area networks, and external penetration testing on Internet-facing hosts
• Performed penetration testing on web applications
• Performed manual penetration testing to verify vulnerabilities and risks reported in vulnerability assessment tool output reports
• Conducted Federal Desktop Core Configuration compliance scanning, interviewing, auditing and data analysis for FDCC pilot program
• Performed Router, Firewall, and IDS configuration and Log Reviews
• Reviewed Corrective Action Plans resulting from previous Security Test and Evaluations to determine if the
• appropriate measures were taken to correct and close the reported findings

Lead technical analyst for Incident Response for Corporate client:

• Performed External, Web Application, and manual penetration testing as stated above
• Used various penetration testing and vulnerability assessment tools including Nmap, Nessus with Licensed compliance auditor feature , Metasploit, Core Impact, Firefox plug-ins, Netcat, Cain and Able, John the Ripper, Traceroute, NSLookup, VNC, Ethereal/Wireshark, NetStumbler, Kismet, and many other tools and Python scripts available on BackTrack Live CDs

Performed in-house and outsourced Network Engineer/Administrator duties:

• Symantec Backup Exec, Active Directory, Windows Server 2000/2003 and MS Exchange Server 2003
• configuration, maintenance and support
• SonicWall maintenance and support
• Recommended administrative, technical and physical controls to improve the security and/or performance of the organization, technology and/or processes
• VOLUNTEER / PERSONAL CONSULTING 01/1999 Present
• Performed incident response and investigation activities on Windows and Linux workstations and servers infected with malicious software, and also provided information on workstation/server hardening and malicious
• software removal
• The following projects were performed as a requirement of my Master's Degree program: Performed a business process re-engineering project for a company
• Performed HIPAA audit for a company and reported findings, then developed guidelines for the company to follow in order to address areas of non-compliance
• Developed a list of necessary physical and technical server room security requirements to be implemented into the initial design of a new church building for New Life Outreach International Church
• Performed PC troubleshooting and repair, and the configuration of secure wireless networks for numerous companies Performed penetration tests and vulnerability assessments on PCs, networks, wireless networks, Internet-facing hosts