Andrew D. Email & Phone Number

Arlington, Texas, United States

Texas, United States

Sports Photojournalist/Audio Mixing & Mastering

Dallas/Fort Worth Area

Member of Technology Risk Management team (SGIM – Security Governance and Issue Management)Worked as a SME liaison for the technology risk organization handling risk and issue/vulnerability management for various business organizations/RCSAs.Analyzed identified business risk and performed risk ratings, root cause analysis and ultimately coordinated with business units to have remediation performed and closure evidence tested and verified.Worked closely with red team (penetration testers) to organize findings/vulnerabilities, risk rate and facilitate conversations (and ultimately remediation activities) with developers.As the business is under continuous federal audit, I worked closely with the internal audit team to provide data, reports and help facilitate action for matters needing attention.Hands-on daily interaction with a variety of vulnerability management and GRC tools (Qualys, Veracode, JIRA, Archer, ServiceNow, Open Pages, etc).Achievements to note: - Brought down risk acceptances by 50% by working with teams to create remediation milestones and break the cycle of continuous acceptances. - Built system to facilitate remediation of Pentest (Red) findings and developed a playbook based on building procedures for documenting, working with development teams and ultimately remediation of Red Team backlog of test findings. - Part of integration team that was able to successfully integrate a large acquisition’s (TD Ameritrade) GRC platform (Archer) and vulnerability management program (Qualys). Established methods for performing data integrity and transitioning from Archer to Open Pages. An in depth analysis was performed on existing issues/vulnerabilities to clean up and combine remediation efforts into Schwab’s processes which significantly reduced the footprint of reported risk.

Dallas/Fort Worth Area

Contracted to DTCCMember of Technology Risk Management teamServe on threat and vulnerability remediation panel to review and create strategy per our threat intelligence program.Work with various areas of the organization to analyze, remediate and report metrics covering latest cyber threats. Work with penetration testing (Red) team and auditors to rate, prioritize and remediate findings. Serve as SME and provide oversight for computer security baseline implementation and verification.Organize remediation efforts for findings found during the continuous vulnerability detection program.Compile and create metrics reports.Hands-on vulnerability management, platform hardening and compliance testing with Qualys (QualysGuard).

Global

Lead security analyst for the corporate level (TVA) Threat and Vulnerability Assessment program where I managed a team (5 members) tasked with assessing security risk posture for a large global corporation (50k+ employees) within ISRM (Information Security and Risk Management) operations.Leverage industry best practices and frameworks (NIST, ISO27001, PCI/DSS, SOX) to formulate and tailor information security guidelines and create corporate policy.Perform hands-on security assessments on platforms internally (50k+ endpoints), external facing and cloud (20k+ endpoints) utilizing QualysGuard, Veracode, IBM AppScan, etc.Create tangible metrics for remediation efforts as well as high level analysis for executive management.Responsible for gathering and reviewing threat intelligence, CVEs, and patch analysis – provide recommendations and alerting to strategic staff.Serve as liaison between platform architects and Information Security Risk Management to build secure OS images based on CIS Benchmarks and security lockdown standards.Research and provide technical guidance for security initiatives and strategies within the organization.Serve as SME for internal and external security audits.Worked closely with Incident Response teams.Tools: Qualys, RBS VulnDB, IBM AppScan, Veracode, FireEye

Dallas/Fort Worth Area

Worked as independent network and security SME to CISO.Hands-on SME for network infrastructure and information security.Responsible for network design/architecture.Implemented and maintained firewalls, switches, routers, DMZs, ACLs, etc.Utilized various packet sniffing tools using SPAN ports from switches to analyze data traversing network.Monitored infrastructure SIEM alerting, load and investigated potential network breaches.Handled load balancing and troubleshooting for both internal and public facing gateways.SME for local Fort Worth based facility and served as liaison to corporate ISRM and network infrastructure teams.Responsible for Vulnerability Management program.

Dallas/Fort Worth Area

Led a team of network & telecom engineers (6-8 members) as well as end-user support staff (2-3 SOC/Help Desk members).Responsible for network and telecommunications implementation and day-to-day operations for a 400 person multi-location facility.Managed datacenter operations including all aspects of server deployment, infrastructure, LAN/WAN connectivity and email.Managed staff responsible for call center technical operations and voice mail services.Maintained vulnerability and patch management programs.Began initial development of formalized information security program for local BU.Implemented and maintained various monitoring tools (Websense, SolarWinds, PRTG, Snort, etc).Monitored traffic patterns and created baselines as well as performed packet inspection.

Dallas/Fort Worth Area

Hands-on SME senior technical level position.Responsible for technical design and hands-on implementation of datacenter infrastructureSME (hardware/telecom/networking infrastructure)/project manager for several physical corporate relocations and consolidation Architected in-house implementation, maintenance and configuration of a secure web presence (included roll-out of new Cisco equipment, Checkpoint firewalls, design of DMZ's and interconnectivity with public internet providers and WAN infrastructure)

Dallas/Fort Worth Area

Dallas/Fort Worth Area

Dallas/Fort Worth Area

Education record

Education record