Bill Smartt Email & Phone Number

Remote, Us

Similar experience as I got working E3, but more focused on a technical project leader, mentor, best practices in detection engineering SDLC, how to use OKRs in detection engineering, mapping MITRE ATTACK (ATT&CK) Tactic and Technique coverage, Precision, Sensitivity, and building a consistent, proactive approach to detection engineering which enables blue teamers to see the impact their work has in detecting and preventing hands on keyboard intrusions / well funded highly motivated and patient adversaries, zero days, and other urgent gaps. Enjoy serving as a technical lead on 3-6 month long projects or at least leading sensor kernel mod development. Owning the timely delivery of the sensor-side functionality and also architecting cross platform (win,mac,linux) solutions, working with Security Response, mssp style service providers aaS, etc).

Remote, Us

Engineer III on CrowdStrike’s flagship product (EDR / NGAV) Engine Content and Development team. Responsible for developing detection patterns (Indicators of Attack) for Windows and infrastructure (i.e. dynamic whitelisting). Focused on Windows defensive models (from APT implants to commodity malware) and driver (kernelmode) development. Passionate about detection and prevention of real threats, designing new ways to stop attacks sooner, such as innovative driver filters and different types of blocking, suspension, and termination mechanics. Formally on the engineering side (scrum, major initiatives, features 🐛, bugs 🐛, offensive and defensive research), shipping code in a highly active code base worked on by 100+ engineers running in the kernel on millions of corporate machines around the world. Tracking down complex bugs (hangs, crashes, leaks, deadlocks, bsod, etc) in Windows kernel driver code (WinDbg / Windows Performance Analyzer) and delivering hot patch fixes and RCA write ups to major customers. Willing and able to fix bugs under pressure and give clear and professional status updates throughout. Position also required threat hunting style data analysis on a massive scale (splunk, kibana, other in house tools, false/true positive/negative analysis), and reproducing individual tactics and sophisticated end to end attack scenarios across the ATT&CK matrix and beyond. Wrote code mainly in windows C++ (kernel mode / user mode) and a proprietary DSL, with plenty of Python/PowerShell, C#/ASM ... Blue team.

Redwood City, Ca, Us

Security Research & Development. Threat Intelligence pipelines (acquisition, consumption, data quality, false positive / true positive analytics), malware analysis, threat hunting. Also contributed to the threatstream platform (main engineering team). Programming done in Python, mostly micro services running on Linux with PostgreSQL.

Primary responsibilities included malware / threat research, product R&D, rapid prototyping, product design / development, security expertise, last line support.Responsible for threat intelligence, security research. I was the first engineer for the OTX threat intelligence platform and stayed on from a team of one to a key part of the company's business strategy, with a team of 8, 15k+ users, 750 Weekly Active Users, 250 Daily Active Users. Lead OTX engineering efforts from the inception through prototyping, primarily responsible for transitioning the product from R&D to engineering under the direction of Jaime Blasco. Today OTX has more than 80k users.Also developed a continuous vulnerability assessment engine which was incorporated into USM in v4.2.

Us

Worked on: internal policies and procedures manuals, SQL administration, acquisition of new rack servers and RAID systems.