Aaron Beardslee Email & Phone Number

Denver, Co, Us

Addison, Texas, United States

HUNTING AND THREAT EMULATIONThe Lead Cyber ThreatHunter supports Threat Labs initiatives to show value to our customers through hunting during Red Team engagements while also providing threat intelligence back to the customer. Performs Purple Team exercises with customers to validate detections. Design and maintain a true-to-form network environment to replicate adversary attack strategies using live cloud C2 infrastructure against on-prem domain networks. Works closely with the Threat Research team to analyze emerging threats and the latest techniques used by nation state threat actors. Develops and executes attack simulations for the Data Science team to test and validate threat models.ADDITIONAL PROJECTSBuilt multiple CTF scenarios for use in conferences and training to provide hands on learning for customers and colleagues. These scenarios included Active Directory manipulation using Red Team tools Rubeus and Impacket while also incorporating physical attack tools from Hak5 (Bash Bunny and O.MG Elite Adapter) to deliver obfuscated Sliver payloads.

Boulder, Colorado, United States

THREATBLUE RESEARCHThe ThreatBlue Researcher interprets malware and threat actor behavior gathered from live sample analysis, hands on exploit execution, and public research to harden the security posture of the customer. Incident research with the customer. Offline research with internal teams and resources. Identify high risk threats. Awareness of emerging threats. Discovery of evolving techniques. Adoption of adversary tactics. Education on best practice defensive procedures. Emulation implementation of exploits and malware/ransomware detonation. Threat profiling with behavior analysis and log capture. Re-evaluate research application. Use case testing, tuning, and validation. Custom use case design paired with ECHO package delivery. Tabletop exercises with purple team activities using ECHO Packages. SOC readiness testing leveraging threat hunt coaching – What to look for and why you are looking for it. Use of LogRhythm SIEM CASE functionality to track and manage threats.

Boulder, Co

CONSULTINGThe Analytic Co-Pilot Consultant continuously engages with clients to optimize analytics module content to the unique needs of the environment and the customer. Understand customer environment, goals, gaps in coverage. Discuss modules, use cases, rules, log sources required to fill gaps. Plan the execution approach with the customer. Gather information and set out requirements for customer provided data. Enable AI Engine rules. Basic tuning and best practices, dashboard and report creation for new rules. List population for rule requirements. Initial alarm volume monitoring. Tune use cases based on triggered alarms. Investigate false positives. Modify rules/lists to remove future false positives. Finding duplicate rules and overlaps with existing rules. Changing outputs to match customer needs. Testing use cases for true positives. Reviewing deployed rules. Identify SmartResponse Plugins to be used with tuned alarms. Evaluate use cases implemented against initial plan.

Greenwood Village, Colorado

Collaborates with client IT, security teams, and management to achieve the strongest security posture possible. Technical advisor on client’s security environment and SOW deliverables. Escalation point for prioritization of security tasks within Trustwave Managed Security Services. Provides deep subject matter expertise on Trustwave platforms, tailored to client security requirements. Analyzes and reports on security trending, based on data sets provided by Trustwave tools and monitored client security devices. Researches historical and current attack vectors of global threat actors. Generates documentation of customized process and procedures, as necessary, as well as client facing support and training materials. Leverages tools such as Trustwave SIEM, Trustwave WAF, Rapid7 Nexpose, Carbon Black, and Tableau to provide insight into the effectiveness of client defense in depth solutions and execute threat hunting operations.

Greenwood Village, Colorado

Supported SIEM solutions, Web Filter & Reporter appliances, Application Layer Web Proxies and Secure Email Gateways in varied environments ranging from small school networks to worldwide enterprise MSSPs. Worked closely with engineering teams, resolving complex hardware/software issues and reporting bugs.SIEMInstallation and configuration of multi-tier SIEM as an appliance or VM with local/remote data collectors and analytical tiers communicating to a central storage tier. Extensive troubleshooting of the relationship/communication between RHEL, Apache Tomcat, MySQL and Perl. Ensured tuning of the LAMP stack to provide healthy system performance. Meticulous testing of customer data for proper formatting, parsing and taxonomy of network device events. Determined through log analysis communication breakdown between server tiers with resolution involving database rebuilds/imports, MySQL table manipulation, ldap database certificate import/validation, and service tuning. Conducted lab testing of new patches and software packages before distribution to the public.WEB FILTER & REPORTERProvided customers with guidance on how to configure network settings and ACL to allow communication to Trustwave’s proprietary appliances and software. Created rule policies according to school/business legal requirements to accommodate effective balance between availability and confidentiality. Configured Active Directory GPOs and logon scripts. Tested Netuse and LDAP communication between end user workstations, web filter, and the network Domain Controllers. MARSHAL PRODUCT LINE (Secure Email Gateway and Web Proxy)Manipulated Email Gateway services to provide uninterrupted mail flow to internal Exchange servers. Built, and properly placed, mail filter rules for proper processing of virus scanning, spam blocking, white and black lists, dead letter policy, attachment scanning, and content filtering.

Colorado Springs, Colorado Area

Supported 56 bases and GSUs (Globally Separated Units) with 400,000 users. Used centralized management tools (McAfee Control Center and Bluecoat Director) to provide operations and maintenance to 120 firewalls and 60 proxy devices. Provided O&M to base firewalls and proxies utilizing log analysis, security posture monitoring, and application of best practice to emphasize security balanced with availability. Part of team standing up a new global network in support of critical mission systems. Leveraged ITIL concepts of change management using the Remedy system to organize and categorize workloads via requests approved for implementation or troubleshooting. Stressed and observed maintenance windows to preserve network stability. Practiced TPI (two person integrity) to validate quality changes without service loss. Formalized reports regarding the health and vulnerabilities of the Air Force firewalls, as well as updating the asset database. Part of team rebuilding firewalls utilizing custom shell scripts.

Certified Ethical Hacker, Computer And Information Systems Security/Information Assurance, 84

Associate Of Science (A.S.), Physical Sciences, 3.54

Law Enforcement Technologies Certificate