Currently working as a Security Operations Center Lead, responsible for investigating & eradicating major information security incidents across Lumen Technologies enterprise.
Proven capacity to drive all phases of the incident response plan.
Proficient in conducting investigations on compromised workstations & servers. (Using CrowdStrike, Fire Eye HX, Tanium & or Microsoft Defender)
Ability to work extremely well under pressure, while maintaining a professional image and approach.
Capable of simultaneously managing multiple efforts.
Excellent Linux engineering background of 8 years.
Overview
16
16
years of professional experience
Work History
Sr. Info. Security Engineer
Optum, UnitedHealth Group
Wentzville, MO
07.2022 - Current
Identified security threats, vulnerabilities and potential malicious activities through log analysis.
Developed and implemented strategies to detect emerging cyber threats.
Performed incident response and root cause analysis on security incidents.
Installed firewalls, intrusion detection systems, anti-virus software and other security measures to protect networks from outside attacks.
Act as a primary resource for support and management of the enterprise-wide Tanium platform
Lead efforts in the creation and monitoring of dashboards within Tanium to drive improvements throughout the environment.
Utilize Tanium telemetry to promote automation efforts across the various functions within the Digital Technology organization.
Mentor other team members on best practices within the Tanium platform
Lead the creation and maintenance of all Tanium-related documentation!
Provide 3rd level technical support for all deployed security platforms.
Perform and oversee daily administration tasks such as maintaining a version status for all deployed products and policies, including the staging and execution of minor platform upgrades.
Provide subject matter expertise and help maintain all security platforms (threat protection software), SIEM (Security Information & Event Management), SOAR/SIR, EDR, email ATP (Advanced Threat Protection) solution, etc.
Participate in rotating on-call schedule for after-hours support as needed.
Recommend best practices and look for opportunities to improve processes while balancing operational and business risks.
Senior SOC Analyst
Lumen Technologies (CenturyLink)
Chesterfield, MO
08.2017 - 07.2022
Identified security threats, vulnerabilities and potential malicious activities through log analysis.
Developed and implemented strategies to detect emerging cyber threats.
Monitored network traffic for suspicious activity using SIEM tools such as Splunk and LogRhythm.
Performed incident response and root cause analysis on security incidents.
Installed firewalls, intrusion detection systems, anti-virus software and other security measures to protect networks from outside attacks.
Conducted vulnerability assessments of IT systems and applications.
Analyzed logs from various sources including web servers, application servers, databases, IDS and IPS systems. for possible security breaches.
Created detailed reports outlining the findings of investigations into security events or incidents.
Provided technical guidance in developing secure architecture designs for new projects or initiatives.
Implemented processes to ensure compliance with industry regulations such as PCI DSS, GDPR, HIPAA.
Collaborated with internal teams to improve system performance and enhance overall security posture of the organization's infrastructure.
Maintained up-to-date knowledge of cyber threat landscape by researching latest attack trends and techniques used by attackers.
Assisted in designing effective risk mitigation plans based on identified risks.
Evaluated current policies to identify gaps in existing controls.
Responded promptly to any reported issues or alerts related to system or network security.
Investigated advanced persistent threats in order to understand their behavior patterns.
Developed scripts and automation tools for efficient log management operations.
Ensured that all security protocols are being followed within an organization's environment.
Provided ongoing support during incident resolution process ensuring successful containment and eradication of malware infections.
Analyzed system risk to identify and implement appropriate security countermeasures.
Managed user authentication and authorization of data access.
Monitored server event logs to identify and resolve performance and security issues.
Supported users with in-person and remote technical assistance.
Audited networks and security systems to identify vulnerabilities.
Designed and implemented plans to secure computer files against breach, destruction or accidental modification.
Built firewalls and encrypted data to secure confidential information.
Generated reports using statistical software in response to user requests.
Researched, planned and implemented small- and large-scale improvements to address changing conditions and needs.
Investigated information security breaches to identify vulnerabilities and evaluate damage.
Made recommendations to improve security procedures and systems.
SOC Analyst II
State Farm
Phoenix, AZ
03.2013 - 07.2017
Developed and implemented strategies to detect emerging cyber threats.
Maintained up-to-date knowledge of cyber threat landscape by researching latest attack trends and techniques used by attackers.
Responded promptly to any reported issues or alerts related to system or network security.
· Analyze security event data from the network (IDS, SIEM).
· Experienced with data search software such as Splunk Phantom and Crowdstrike Falcon.
Mid-senior role within the 24x7 security operations center.
Proficiently make use of SIEM / SOAR / EDR technologies in use by Insight SOC for threat detection and response.
Build and maintain a relationship with each client to maximize threat prevention, detection, and reporting capabilities for their environment.
Identify indicators of compromise within threat events and collaborate with SOC Engineering to configure tools for future alerting.
Report specific, measurable, achievable, relevant, and timely cybersecurity incidents to clients.
Provide the client’s cybersecurity incident response team with intelligence from the tools.
Documented problems and resolution for future reference.
Senior Redhat Linux Engineer
State Farm
Chesterfield, MO
02.2008 - 03.2013
Developed and maintained Linux systems, including patching, configuration management, and troubleshooting.
Deployed and configured applications on multiple Linux distributions.
Created scripts to automate system administration tasks in Bash and Python.
Configured networking services such as DNS, DHCP, NFS and Samba for file sharing.
Monitored performance of Linux servers using tools such as Nagios and Cacti.
Managed virtualization platforms like KVM, XenServer and VMware ESX and ESXi server.
Troubleshooted hardware issues related to servers and storage devices.
Implemented security policies for Linux systems based on industry standards.
Performed regular backups of critical data using Red Hat Cluster Suite or DRBD replication technologies and bacula.
Provided 24x7 support for mission-critical systems running on Linux platform.
Installed, configured and maintained web servers with scripting languages like PHP and Perl.
Designed secure networks utilizing firewalls to protect against malicious attacks.
Conducted capacity planning analysis to ensure optimal utilization of resources across the infrastructure.
Evaluated open source software solutions for various business requirements.
Assisted developers in setting up development environments using Docker containers.
Automated daily system administration activities through Ansible playbooks.
Communicated with clients to understand system requirements.
Provided technical guidance for system development and troubleshooting.
Provided status updates to keep upper management informed and to reach goals.
Verified stability, security and scalability of system architecture.
Advised on project costs, concepts or design changes.
Planned, implemented and integrated updated system-oriented projects.
Provided exemplary helpdesk service and support to assist customers.
Led cross-functional teams in systems integration projects.
Designed and delivered mission-critical infrastructure to maintain consistent availability and performance.
Coordinated and enhanced existing databases and established new databases as part of initiative.
Recorded systems information and documented design specifications and installation instructions.
Administered application stacks and executed performance tuning to optimize session performance by eliminating performance bottlenecks.