Brett Fitzpatrick Email & Phone Number

Boston, Massachusetts, Us

Threat Intel & Hunt

Mountain View, Wy, Us

Architecting proactive threat intelligence solutions for defense.Architected and developed a serverless enrichments service to enrich cyber observables from a petabyte-scale log sources.Submitted RFCs to Elastic Common Schema (ECS) to further enhance its ability to handle cyber observables and indicators.

Vienna, Virginia, Us

Lead Technical Architect & Engineer of IronRadarPriorities:- Assist in the development and execution of a product vision- Architect a proactive threat intelligence solution that collects network and system observables via active network scanning and disseminates the threat intelligence in consumable formats.- Develop detection capabilities of actor infrastructure via network scanning to obtain artifacts and observables for the collection of threat intelligence.Experience:- Provider: AWS, Digital Ocean- Compute: EC2, Lambda, Fargate, Droplets- Environment: Docker- Container Registry: Docker Hub, ECR- Container Orchestration: ECS, Docker Swarm- Data Stores: PostgreSQL, DynamoDB, S3, Elasticsearch- Data Schemas: Elastic Common Schema (ECS)- API Gateway: Traefik, AWS API Gateway- CDN: Cloudfront- DNS: Route53- Automation: Slackbots (SlackOps), JIRA- Software Development / DevOps: - Environment: Github Actions - Versioning: Semantic - Languages: Python, Go - Dependency Management: Renovate, Dependabot - Security: Snyk, Dependabot, Twistlock - Schemas: YAML, JSON, TOML, x509, STIX - Documentation: Mkdocs, Markdown, Confluence, JIRA / GitHub Issues (issue tracking) - Linting / Analysis: CodeQL, Reviewdog, Pylint, Codecov / Coverage - Monitoring: Elasticsearch, Elastic APM, CloudwatchEnablement Team - Threat Analysis | Cyber Operations Center (CyOC)Responsibilities:- Threat intel report generation for internal and external audiences- Collaborated with trusted third-parties and government agencies in the identification, remediation, and targeting of cyber threats.- Architected a solution to disseminate network observables to IronNet's NDR appliances.- Architected a solution to "hygiene" observables prior to release- Architected a solution to detect network threats using a SIGMA based schema and opensearch datastore.

Vienna, Virginia, Us

ACTIVE COMAND AND CONTROL SERVER DETECTION VIA DISTRIBUTED NETWORK SCANNING (IronRadar)- Drafted patent claims for submission- 21315-158200-US

Vienna, Virginia, Us

Threat Analysis Team | Cyber Operations Center (CyOC)Priorities:- Develop internal capabilities for the production and collection of threat intelligence observables.- Develop and execute an intelligence-based hunt strategy.- Develop internal capabilities to facilitate hunt operations within on-prem and cloud environments.Tools / Services / Environments:- SIEM: Splunk, Elastic- DB: PostgreSQL, MySQL, SQLite- Container Orchestration: Kubernetes, Docker SwarmLanguages:- Code / Scripting: Python, Bash

Vienna, Virginia, Us

Cyber Operations Hunt Team- Main Priority: Financial & Healthcare Sectors- Sub: Energy SectorsTools:- SIEM: Splunk, Elastic, LogRhythm- FW/NTA/NDR: Palo Alto FW, Cisco FirePower, IronNet IronDefense- EDR: Microsoft Defender, Cisco AMPLanguages:- Query: SQL, SPL, Lucene, PySpark/Scala- Code / Scripting: Python, Scala, BashResponsibilities:- Report generation & Customer Engagements (incident response, purple team exercises)- Develop and execute threat hunting strategy- Develop detections in SIEMs using log correlation and threat intelligence.- Develop internal and external toolsets for executing hunt capabilities, automating operations to decrease mean-time-to-triage, and facilitating access management into on-prem and cloud environments.- Ensure compliance with relevant standards per sector.

Cupertino, California, Us

Bachelor Of Science (Bs), Computing Security

High School Diploma