Ben Knowles Email & Phone Number

Greater Atlanta Area

Technology program management and development for a sophisticated, complex, and growing Cyber Ops capability at a large financial services firm. I selected, designed, planned, and operationalised existing and incoming major processes and technologies for visibility, detection, response, and threat intelligence working closely with partners throughout the business and the information security community to help build a defensive operation for an enormous 100 + year old successful organization under constant attack and regulatory scrutiny. I also coordinated training and professional development work for teams and individuals, gave a few presentations myself, and taught a few classes in between meetings.

Greater Atlanta Area

* intrusion analysis, enterprise incident response, threat hunting * processing and analysis of file, network, volatile, and non-volatile host evidence * static, surface, and dynamic malware analysis of suspicious files and URLs* DFIR and analysis process engineering and improvement projects * detection rules authoring and testing* workshops, brownbag series, mentoring

Greater Atlanta Area

* intrusion analysis, enterprise incident response, threat hunting* processing and analysis of file, network, volatile, and non-volatile host evidence* static, surface, and dynamic malware analysis of suspicious files and URLs* DFIR and analysis process engineering* workshops, brownbags, study groups, mentoring

Atlanta, Ga, Usa

As senior security engineer my work focuses on project and consulting work to improve monitoring and defenses and enhance internal security processes. Specifically in 2014 I worked on enhancing incident response including analysis, triage, and remediation tools and procedures and in 2015 led a major update to the Incident Response Plan and supporting applications, policy, and procedures. I've also helped deploy incident management applications, host visibility solutions, and other security technology.I'm doing a great deal of security incident coordination and host and network forensics analysis primarily with FOSS tools such as Volatility, Rekall, SIFT, and Security Onion and some select commercial tools. I do static file analysis on samples with REMnux before handing off public sandboxes or to vendors, acquire and process host forensics data, and look at network evidence in Wireshark and commercial tools.As part of improving response I've done process development and tooling, engaged other technical and management teams in outreach, led workshops on analysis and response procedures, given technical "brownbag" presentations on topics of interest to the security team, and have now run three book study groups : NSM, Security+, and introduction to malware analysis.

Greater Atlanta Area

I was (almost) a founding member of the Dell SecureWorks CIRT, was the Countermeasures lead analyst, and then was lead responder for a year.DSWXCIRT defends and respond to incidents for the SecureWorks organization and assisted Dell in some matters as well. The protected organizations are themselves made up of primarily security experts including some of the world's best minds in forensics and malware, professional security consultants, and world class DSWX Security Operations Centers globally. It was certainly a challenging and educational environment in which to learn and conduct incident response.

NOC sysadmin: internal systems support, incident response, IT service delivery

2009I wrote and maintain MooCash, a Moodle Zencart middleware package. Along with this I have also done contract system integration of Win, Mac, Linux Servers running open source software for businesses in the North Atlanta Metro area.

Industrial system administration of thousands of Linux and hundreds of Windows servers in NOC and DataCenter environment in a private facility for dedicated and co-located hosting customers

Contexo acquired MMI in Spring 2006. We helped migrate people, hardware, and services from the Salt Lake City, UT office to Atlanta and back. In addition to the Linux and Mac Servers I had managed for MMI we picked up management and support of production Windows servers in SLC and in colocation. Designed and planned a national scale network for Contexo's business plan including integrated Windows, Linux, and Mac directories and services.

I managed a small workgroup network of Macs and PC on Mac and Linux servers. With my teammate, we rebuilt the network from scratch, stabilized and expanded services, vastly increased security and reliability and developed a small test preparation application in Java that sold several thousand boxed copies. For that project I was the toolsmith and a junior developer.

I taught Intro to PC Tech classes part time to diverse groups at local computer shops. I helped students prepare for the A+, Net+, MCSA, and MCSE certification tests and work as support and repair technicians. I used Linux boot media (tomsrtbt) and open source tools including memtest86 and lspci to teach architecture and troubleshooting and old PCs and Macs to teach hardware and repair.

Associate Of Science, Psychology

Activities and Societies: Computer Club, Study Abroad London 2002

Associate Of Science, Computer Science

Activities and Societies: Computer Club, Study Abroad London 2002

Computer Science

Activities and Societies: Anime Otekku, GTAR

Associate Of Science, Computer Science

Activities and Societies: CSO, SKY, Computer Lab

Academic Diploma, Magnet

Activities and Societies: Constitution Bowl, Jazz Band, One Act Play Competition, Video Annual