• Conducted intensive Level 1 & 2 investigations into possible malicious attacks alerted through Cortex XDR, utilizing several high valued security tools. • Performed daily threat intelligence research to discover current up-to-date attacks and created threat intelligence reports to share with team. • Collaborated with other team members to create a database that would gather necessary machine information that would aid in enhancing our investigations utilizing SQL Server Management Studio. • Collaborated with other team members to create xSOAR automation that would assist in the creation and completion of investigation alerts. • Created new security alert notables within Cortex XDR to catch current and newer malicious threats. • Performed IOCs blocking on current malware attacks (hashes, Ips, urls). • Enhanced the security posture within the AOT Cybersecurity space based on the NIST Cybersecurity Framework.

• Managed the daily web filter exception and network firewall request queues.• Created JIRA templates to utilize for cataloging web filter exception and network firewall requests.• Authored numerous SOPs focused on handling Threat Analysis, IOC Sweeps, and blocking.• Monitored multiple health intelligence security forums to find zero-day attacks and current global security threats.• Performed threat analysis on current malware attacks by performing network sweeps throughout the Highmark environments (Defender,Sentinel, Splunk).• Performed IOCs blocking on current malware attacks (hashes, Ips, urls).• Authored weekly threat intelligence reports to provide updates to executive leadership.

• Created automated playbooks surrounding the web filter exception requests along with the network firewall requests.• Created and maintained dashboards tied to the metrics surrounding the web filter exception and firewall requests.• Cross trained other members of the Cyber Investigations team on handling the daily queue requests.• Reduced the time spent on daily queue requests by over 75%.• Collaborated with the Third-Party Risk team to investigate on-going vendor security incidents.• Authored an audit approved third-party investigation SOP and questionnaire to provide to the vendors.• Partnered with the Cyber Incident Response team to reviews logs to determine if the third-party incident effected Highmark domains.• Led the initiative towards reviewing Generative AI within the organization.• Created queries within Splunk to track the usage of all known AI websites and IP addresses across the enterprise.• Developed a new request form and automation playbook for requesting Generative AI access.• Collaborated with members from IAM, Network Security and Data Governance to create new Active Directory groups and network firewallrules.• Collaborated with other teams within ISRM to implement the migration of firewalls from BlueCoat to the Palo Alto.• Assisted with collecting audit artifacts related to Third-Party incidents and identified gaps in the current incident investigation process.• Identified gaps in the current SECURE Index program and provide solutions to close the gaps.• Collaborated with members of the Vulnerability Management team to review SECURE Index capabilities.

• Developed a unique system within the Cyber Defense team which would separate out areas of business by sub-groups to improve theeffectiveness of the team and provide better quality deliverables to our customers.• Led the Priority AV and EDR Mitigation project which focused on getting over 70,000 devices, endpoints and servers secured with theappropriate Antivirus and Endpoint Detection and Response applications.• Aided team members as the Change Agent by providing them an opportunity to express concerns, questions, and grievances, which thenwere escalated to executive management to enact change.• Participated in Boss of the SOC and capture the flag activities within the Cyber Fusion Center (SOC).• Collaborated with members of the team to constantly improve current documentation to allow for higher quality results.• Collaborated with other Cyber Defense team members and other security employees to create use cases for xSOAR playbooks whichallowed for better quality automation.• Investigated current zero-day and malware attacks and blocked relative Indicators of Compromise.• Authored weekly threat intelligence reports about ongoing and new security threats and attacks, which then were presented to executivemanagement.• Conducted intensive Level 2 investigations into possible malicious internal and external attacks utilizing several high valued security tools.• Participated in weekly advanced threat hunting training.