Aubrey P. Email & Phone Number

Boston, Massachusetts, United States

• Adversary Tracking Management: Oversaw the tracking of adversaries to maintain up-to-date threat intelligence.• Leadership in Threat Intelligence: Led the Threat Research Unit, directing a team of six to achieve strategic objectives.• Product Enhancement: Analyzed data and integrated threat knowledge to improve tracking capabilities using frameworks like MITRE ATT&CK.• Annual Threat Report Management: Coordinated the delivery of the annual threat report, working with Marketing, Directors, and managing external contractor relationships.• Publications and Features: Contributed to notable articles and reports in prominent platforms such as Dice, SC Magazine, The Record, Dark Reading, SiliconANGLE, and VentureBeat, addressing a wide range of cybersecurity topics.• Expertise in CVEs and CVSS: Extensively used CVEs and CVSS to identify overlooked security best practices and co-authored two in-depth industry reports.

North Billerica, Massachusetts

• Reviewed and Replaced EDR Capabilities: Identified, tested, validated, and deployed a new EDR solution.• EDR Management: Triaged events, trained users, reviewed and modified policies, and leveraged advanced hunting features.• IT Security Controls Management: Developed, tested, maintained, and audited security controls in compliance with CMMC and NIST 800-53 standards.• SCCM Team Security Member: Identified and remediated risks through patching and testing.• Vulnerability Management: Monitored deployed applications and their patch statuses, coordinated patching and remediation with users.• CVE and CVSS Analysis: Assessed risk based on CVEs and CVSS scores to justify patching decisions.• Threat Analysis with MITRE ATT&CK: Evaluated adversary behaviors and identified threats targeting FLIR.

Seattle, Washington

While with the City of Seattle as a contractor I was responsible for the provision of information security services through risk management, awareness, and protection for the City of Seattle and those we serve. As part of the Information Assurance (IA) Team I served all city departments with security enablement services. Services I provided included cybersecurity risk assessments, consulting, and threat intelligence; all of these services were provided primarily through risk management of projects to proactively identify security control gaps and provide actionable guidance to improve the City’s security postureThis was a contract role which is now over

Redmond, Wa

• Support and maintain MSRC existing services and SLA to deliver security updates to our customers. o Help to make the MSRC a cohesive, effective and successful team, partnering with key teams within the MSRC and Microsoft to increase trust with our finders and help make all our customers more secure. o Work with bug finders/customers to address security issues in Microsoft products by working with Product Groups to coordinate fixes for release

Redmond, Wa

• Supported the defense of Microsoft and its customers against advanced persistent threats (APT) by developing and delivering unique, timely, relevant, and high-quality intelligence to Microsoft defenderso Produced context on advanced and targeted threats which inform Microsoft and customers during investigations and incidentso Produced production-quality indicators of compromise (IoCs) and analytics to enhance detection for Microsoft’s own network as well as across products and serviceso Built and maintained external and internal relationships which enhanced Microsoft Threat Intelligence Center’s capability to deliver effective threat intelligenceo Leveraged Microsoft proprietary infrastructure to prosecute APT by pivoting off known IoCs to identify additional behaviors and capabilities of adversary groups

Beaverton, Or

• Perform log analysis and monitor and respond to security events.o Respond to security events driving issues to closure engaging all appropriate resourceso Document Security process and procedureso Support service request in-take process and communicate back to requesters promptlyo Provide enforcement of security policies, standards and procedures

Columbia, Maryland

• Pore through operational and network data, in the form of Bro logs and wireshark/tcpdump, to find interesting heuristic data to define anomalous and known activity in an effort to find early signs of exfiltration, compromised hosts, or breach of policy in assigned network spaces. o Write scripts in python that are added to a proprietary solution that looks for defined metrics, scoring and adding found metrics to a SQLite database of processed data. o Developed the Command Line Interpreter tool that provides analyst access to information in the SQLite database, the tool offers a wide range of options and presents data in a clean usable manner. o Tools have enabled analysts to be more productive and efficient. o Developed a means of investigating score data to recognize change in a system as an early marker of security concern. o Scrutinize pcap to verify protocols and network traffic. o Research security trends and protocols to test theories and practices.

• Perform tasking for collection to specialized systems, respond to data gaps and data flow problems, and assess the measure of effectiveness to tasked collection at the direction of and in coordination with the Senior Collection and Executive Officer (SCEO) o Gather information on targets and perform analysis on information gathered o Task signatures and selectors to data sources in response to operational requirements o Query databases to assist SCEO to measure effectiveness of collection strategies, refine tasking, and provide status/metrics of tasked signatures o Assist in the development of collection strategies in response to operational requirements

o Provided analytic guidance and advice to computer scientists and mathematicians o Researched and implemented dynamic means of providing network defense and intrusion detection capability to front line administrative positions o Designed and implemented new practices in front end inspection of packet data, processing network data in near real time with minimal delay in communications o Analyzed activity to ensure highest accuracy of intrusion detection practices and mitigated false positives o Researched automation of network anomaly detection and traffic flow maintenance of asynchronous traffic routing o Lead and developed mission, performed as a team lead and training lead o Synchronized mission with headquarters to provide seamless analytic presence across enterprise o Developed mitigation for malware and network activity identified as potentially malicious to Department of Defense (DoD) networks o Analyzed malicious binaries in a sandboxed network; utilizing tools like OllyDbg, Sysinternals suite, and others o Researched malicious binary practices and trained extensively to identify a variety of malware deployment types for example; Malware embedded in other files, obfuscation techniques, and unique file encryption techniques utilized in malware delivery o Managed acquisition of resources and implementation of new technologies in malware lab o Conducted triage of cached cyber hacking activity in defense of DoD networks o Conducted triage of potential malware files, reviewing collected files to determine whether files were malicious or of other intelligence value o Analyzed network environments for malicious connections/communications o Drafted informal notes to support reporting and mission continuity o Developed strong research in better overall analysis and ultimately my placement in Discovery/Malware mission o Trained peers in discovery/research methods