Andrew Thornton Email & Phone Number

Atlanta, Ga

Spearheaded the architectural design and implementation of all technology and product components for a managed detection and response service at a cybersecurity startup as the first hire. • Created MDR platform comprised of Tanium, Cisco Umbrella, Deep Instinct, and other internally built tools, bringing enterprise level capabilities to smaller environments, increasing their security posture. • Implemented entire security stack for securing corporate assets and networks along with customer systems running macOS and Windows operating systems. • Designed and implemented a customer facing portal using python, postgres, and reactjs running in AWS, instrumental in achieving large customer growth. • Created technology to ingest data points used for security posture rating and remediation item identification, giving enterprise customers real time visibility into their partner’s security posture. • Implemented Splunk for data aggregation and correlation of security events, decreasing MTTD. • Uses python to orchestrate and automate security processes, increasing consistency of outcomes. • Makes use of python and multiple Tanium and third party APIs to automate, orchestrate, and enhance detection and response activities

Atlanta, Georgia, Us

Responsible for creating and leading the Threat Detection & Response center at The Home Depot in Atlanta, Georgia. Reported directly to the CISO. Provided technical and strategic direction to multiple groups including threat intelligence, digital forensics, security operations center, incident response and an offensive security team. Briefed Directors, Vice Presidents, C-level staff and Board of Director members on multiple facets of the program. Managed budgeting, procurement, operation, technical and strategic direction of the program.

Atlanta, Georgia, Us

Created and lead an offensive security team that performed ongoing large scale external, unauthenticated, unannounced testing of the production environment. Choreographed penetration testing from scope creation and analysis to final reporting. Briefed Senior management, to include Vice Presidents and Executive Leaders on security issues that have been identified within their programs. Performed final reviews on all deliverables to include technical validation of findings. Helped technical stakeholders with forming remediation strategies. Partnered with the security operation center to ensure that malicious traffic and host based indications of compromise are identified and responded to quickly and effectively. Acted as a subject matter expert for offensive security topics and remediation steps. Helped set enterprise security priorities.

Atlanta, Georgia, Us

Ensured that the security posture of one of the largest e-commerce platforms in the world is as strong as possible through performing application security testing and code review. Partnered with business process owners to explain risks and to help balance security controls with functionality. Responsible for project management and delivery of security findings for multiple initiatives. Partnered with developers at all levels to help them understand how to support compliance on a technical level with given regulations. Reviewed code and performed technical assessment prior to production migrations using Burp Proxy along with other tools.

Washington, Dc, Us

Performed penetration testing activity against DoD enterprise networks. Responsible for assessing the technical compliance status of multiple programs within the organization against multiple commercial and government compliance regulations to include DIACAP, PCI-DSS and general DoD Technical Implementation Guidance. Ensured that applications were free from common web based vulnerabilities to include those found within the OWASP Top 10. Created a program that was responsible for runtime analysis of iOS applications to determine data how data was handled and secured.

Chicago, Illinois, Us

Worked as a PCI QSA responsible for technical and procedural auditing of a number of fortune 500 companies to determine compliance with the Payment Card Industry Digital Security Standard. Encountered all types of operating systems, network systems and security systems. Reviewed system implementation documentation and configurations for various types of security devices to include firewalls, network and host based intrusion detection devices, load balancers, log aggregation devices, etc. Created reports on compliance. Created and audited security policies for clients.

Atlanta, Ga, Us

Performed web application assessments and penetration tests for large clients in the financial, health care and manufacturing space. Assisted clients with deciphering and mapping given regulations to security practices. Responsible for managing clients, deadlines, process and procedures and delivery. Created new security programs for application security and threat detection.

Reston, Va, Us

Responsible for designing, implementing, and maintaining a security operations center for the aggregation and analysis of events from 14 NNSA sites to include National Labs. Implemented secured systems and the policies and procedures for the creation of those systems. Implemented large SIEM instances in all Linux environments. Performed incident response on multiple high visibility security breaches.

Reston, Va, Us

Assessed the external security posture of regional headquarters for Department of Defense activity to include application security analysis. Created, deployed and audited firewall access lists, reviewed security device logs and reported findings detailing possible malicious or abusive activities. Researched and presented emerging security technologies to government officials. Tracked compliance with various regulations and reported monthly to Sr. leadership. Performed incident response.