Allen Smithwick (Ms,Cissp,Ceh) Email & Phone Number

Knoxville Metropolitan Area

Led the transition to a new Managed Security Service Provider (MSSP) (Arctic Wolf Networks), expanding monitoring capabilities to encompass AWS, Azure, Mimecast, Entra, Defender, and CSPM for cloud environments. Implemented a new toolset during MSSP transition primarily based on the Microsoft Suite to optimize budget expenditure on licensing, focusing on Extended Detection and Response (XDR).Conducted regular security assessments and audits to identify vulnerabilities and gaps in security controls, implementing remediation measures to mitigate risks. Emphasized the use of open-source tools for internal validation, ensuring quicker turnaround in assessments and enabling internal staff to actively participate in security initiatives.Enhanced automation and orchestration efforts leveraging Splunk data, creating PowerShell and Python scripts for various security operations including but not limited to IP and URL blocklist creation, threat hunting, and user and device management, enforcement of security policy. Merged multiple sources of vulnerability telemetry (AWN and Defender) into single source providing a more holistic view of system risk. Automated JIRA ticket creation for devices which violated defined thresholds. Expanded Multi-Factor Authentication (MFA) primarily using Azure (Entra) MFA to optimize costs and strengthen security measures. Implemented conditional access policies to control session lengths and enforce additional security requirements for accessing both sensitive and administrative applications | portals.Eliminated local admin usage on endpoints by integrating Local Administrator Password Solution (LAPS) and Endpoint Privilege Management (EPM), enforced through Intune policies.Utilized Role-Based Access Control (RBAC) with time-based group activation to limit Azure (Entra) elevated permissions, requiring approval for most sensitive privileges.

Knoxville, Tennessee Area

Operating as the sole security operator for the first 4 years at RSC. Spearheaded the implementation of the initial security program, utilizing an open-source solution for preliminary assessments and driving data-driven decisions. Successfully justified budget allocations for commercial toolsets by leveraging assessment results to highlight critical security gaps and risks.Orchestrated the integration of a comprehensive commercial toolset including Nessus (later Tenable IO), Splunk for logging and SIEM, Manage Engine Patch Management, and KnowBe4 for security awareness training.Modernized all Domain Controller, DNS, DHCP servers globally to enhance redundancy, continuity, and overall performance by controlling replication paths. Developed and implemented a formal systems management program, creating hardened OS images and Deployment Guides aligned with CIS Benchmarks, NIST Best Practices, and SCAP recommendations.Established Role-Based Access Control (RBAC) for on-premises server administrative access, ensuring granular permission delegation and removal of persistent memberships in high-privileged groups. Introduced Multi-Factor Authentication (MFA) using Cisco Duo for rapid deployment, enhancing overall security posture and user authentication processes.Utilized Splunk to create custom data models and dashboards for various security aspects including traffic analysis, threat detection, user activity, and system vulnerability assessment. Authored PowerShell and Python scripts for ingestion of diverse data into Splunk, streamlining security operations and data analysis.Led a team of 5 individuals in restoring systems and services globally within 10 days following a critical security event while performing mitigations. Facilitated the transition to Managed Security Service Provider (MSSP) (ESentire) following a critical security event, integrating managed Tenable IO and Carbon Black for Endpoint Detection and Response (EDR).

Knoxville, Tennessee Area

Provided comprehensive support for internal ICG systems and managed service customers, ensuring uninterrupted service delivery. Managed and optimized edge and internal networks utilizing Fortinet firewalls and Dell switches, ensuring robust security and efficient data flow. Oversaw deployment and maintenance of external DNS services and domain registrations, ensuring reliable connectivity.Implemented network segmentation and centralized systems management for Tennessee School of Beauty entities at ICG HQ's Co-Location facility, enhancing operational efficiency and security. Led Microsoft core service management, including Domain Controllers, DNS Servers, Group Policy, SCCM, and Exchange, ensuring seamless operation and high performance. Orchestrated patch management deployments and software packaging using SCCM and other remote tools, enhancing system reliability and security.Acted as the primary point of contact for security-related incidents, orchestrating containment, remediation, and restoration efforts in response to cyber events such as Crypto Lockers and Targeted Email Campaigns. Conducted assessments and provided guidance on compliance and governance frameworks, implementing standardization based on NIST and CIS guidelines. Developed an OSINT (Open-Source Intelligence) platform for vulnerability assessment, log collection, and analysis, leveraging Splunk Free tier services for persistent monitoring and alerts.Designed and implemented a custom monitoring tool for ERP systems running in AWS, enhancing performance monitoring and reporting capabilities through a web-based API Flask application. Leveraged AWS for monitoring capabilities of external services.

New deployment and overhaul of the Security Operations Center (SOC) in response to a company split, with a specific focus on enhancing multi-tenancy capabilities. Facilitated communication and collaboration among various operational, network, and security teams, including Management/Leadership, Engineering, CIRT, Operations, and Analysts. Developed comprehensive incident response plans and procedures, outlining analysis methodologies and protocols, and documented the SOC's playbook for analysis and response.Implemented Splunk and Splunk ES as the primary Security Information and Event Management (SIEM) solution, alongside Acher for Incident Handling, streamlining security operations. Designed and implemented custom data models, lookups, reports, and dashboards in Splunk and Splunk ES, consolidating multiple signal sources for comprehensive threat visibility and sharing dashboards for streamlined investigations. Leveraged Splunk SDK/API to automate repetitive tasks, enhancing efficiency and reducing reliance on manual suppression.Conducted advanced malware analysis using multiple tools such as McAfee EPO, HBGary, Bromium, and Nessus, supplemented by independent research, to enhance threat detection capabilities.Reviewed logs from Windows and Linux systems, assisting in privilege assignment and usage assessments, and provided recommendations for mitigation strategies. Advised operational teams on vulnerability assessment, detection, and remediation strategies, actively staying abreast of emerging threats and threat actor Tactics, Techniques, and Procedures (TTPs).Utilized Palo Alto (PAN) next-gen firewalls and Cisco Sourcefire for Intrusion Detection System (IDS) analysis, coordinating with Network Operations Center (NOC) for signature development and deployment.Conducted Packet Capture (PCAP) analysis using Blue Coat Security Analytics Platform (SAP), leveraging tools like Wireshark, NetWitness, and custom scripts to extract actionable insights.

Oak Ridge, Tn

Architected and Deployed SCCM for internal organization and several customer entities, upgrading internal architecture from SCCM 2007 to SCCM 2012 with distributed multi-site hierarchy.Acted as subject matter expert (SME) for bid and proposal work and operational support, performing assessment and deployment of SCCM 2012 for all Orange County California government entities.Served as the primary contact for post-disaster recovery for the Center for Domestic Preparedness (CDP).Enhanced software deployment consistency and reliability, focusing on user-centric availability by converting the media library to digital with customized installation/uninstallation.Utilized advanced application packaging techniques, including traditional transformation (MSP/MSI MST), scripted software solutions (Autoit, batch, vbscript wrappers), and custom MSI packaging techniques (Admin Studio).Managed active directory (AD) and AD group policy, developing and deploying managed desktop solutions adhering to various compliance levels such as NIST (FDCC/USGCB, DISA, DoD).Assumed the role of SME for bid and proposal work and operational support for group policy STIG deployment and assessment.Implemented system hardening through custom image modification and STIGs, along with privilege management using Beyond Trust for one-time authorizations and controlled deviations from hardening via STIGs.Ensured changes were compliant with ITIL and ISO 9000, 27000, and 27001 controls, as well as DoD/DISA/800-53 requirements.Contributed to the build-out of the network operations center (NOC), assisting customers with software deployment for migrations to NOC solutions and conducting system monitoring using Nimsoft.

Oak Ridge, Tn

Provided system administration in regards to user account creation for the majority of the systems utilized within the enterprise. Act as point of contact and subject matter expert for the profiles teams when implementing new systems. Front-line point of contact troubleshooting for problems related to user accounts and/or roaming profile issues.Often assist member of other teams and/or companies when performing server migrations. Including providing information about the inner workings for roaming profiles, standard department shares, local login scripts, and information about which company/team/individuals support each systemDeveloped and maintained script(s) for the purpose of automating account creation and changes to the active directory, exchange, and profile elements of domain accounts. These scripts interacted with live information provided by the Identity Management system in order to search possible locations which spanned several servers to identify location and security (ACL) elements of users roaming profile folders and sharesProvided on-going information to developers/administrators within the managed network security team (SAIC) update the Identity Management (IDM) system up to date with current location of Servers, Organization Unit’s, Exchange Servers, Profile location changes (folder / share changes). Attempt to determine root causes and possible fixes related to errors with the IDM system and relay information to administrators for changeAssisted with defining user security requirements when implementing Role Based Access Control(s) (RBAC). Acted as the subject matter expert for the profiles team when testing major implementations of the RBAC system, including changes made after original implementation

Oak Ridge, Tn

SOX Tracking System : RFP, RFC, RFB

Oak Ridge, Tn

Masters, Ia:Cybersecurity

Bs, Information System Security

Activities and Societies: Honors

As, Computer Networking Systems

Activities and Societies: Honors