Cameron Hatzmann Email & Phone Number

Armonk, New York, Ny, Us

▪Use open-source research to develop threat hunt hypothesis for Advanced Persistent Threat (APT) groups and other malicious threat actors.▪Perform TTP based Cyber Threat hunts for 500K endpoints located throughout the global enterprise environment.▪Hunt suspicious behaviors through analysis of EDR data from Carbon Black Response, Carbon Black Detect, CrowdStrike, and Microsoft Defender Advanced Threat Protection as well as SIEM data.▪Examine process data and network activity for suspicious scripts, including PowerShell, Python, and WMIC for malicious use among many others. ▪Recommend threat mitigations and remediation's for malicious activities.▪Develop EDR queries for console detections used as alerts for SOC personnel.▪Developed, implemented, and maintained a “threat hunt lab”, an environment used to conduct malicious activity such as detonating malware and running various exploits/zero-days, stress testing security tool stack and detection rulesets. ▪Analyzed results from lab activity through security tool stack and created detection rules for any gaps found in EDR platforms.▪Conduct threat hunting activities through EDR and SIEM platforms▪Profile threat actors relevant to the business and map techniques and tactics ▪Work with BAAS tools to simulate adversary activities in a testing environment▪Solutioned and designed a threat hunting sandbox environment as a dev station to test and stress security stack and create/tune EDR rules

Plano, Texas, Us

Managed a team and actively participated in:- Lead Incident Response teams during Incident engagements- Conducted IR investigations and respond to network compromises- Network Forensics, Host Forensics, and Incident Handling as needed- Development and delivery of incident response training- Facilitation of Tabletop Exercises, IR assessments, and Content review.- Perform Incident Response and Digital Forensics for clients experiencing a cyber event such as ransomware and Insider Threat.- Use multiple platforms to analyze data to find the root cause of the incidents and helped clients to improve their security measures to prevent future incidents.- Perform Threat Hunting activities on internal company and external client networks to eliminate any incidents before occurring using endpoint detection and response platforms including CarbonBlack, Sentinel One, Palo Alto XDR and Defender ATP.- Collect forensically sound evidence complying Chain of Custody procedures for both legal and internal investigations.- Conduct forensic analysis on multiple platforms including disk, memory and mobile devices using EnCase, FTK, Axiom, Volatility, Rekall, Redline.- Prepare detailed reports including investigation methodology, findings and suggestions for clients as a reference resource for better understanding of the incidents and to improve their defense and response capabilities for future threats.- Analyze network traffic via various Firewalls including Palo Alto, Checkpoint, Fortinet, and Cisco. Packet captures (PCAP) via WireShark and TShark to detect suspicious traffic, unusual remote connections and data exfiltration.- In-depth understanding of multiple SIEM platforms including Splunk, Sentinel, QRadar- Perform dynamic and static malware analysis using isolated lab to identify possible IOCs.- Perform Targeted Compromise Assessments including hunting for the Solarwinds IOCs.

Conshohocken, Pa, Us

▪ Create, staff, and maintain a full-range Cyber Threat Intelligence Program.▪ Follow the CTI Lifecycle, accumulate & validate IoC’s for proper rule building,blocking, and hunting.▪ Threat Actor Profiling: study adversary attacks and create profiling forgreatest threats.▪ Link Analysis: Maltego usage to correlate cyber attacks with threat actorsaround the globe, projecting what attacks are most imminent includingdeception technology to monitor and observe active intruders▪ Built a multi-year strategic plan and roadmap for CTI / TH to benext-generation, with tracking and progress goals.▪ Build, manage, and train Threat Hunting Team▪ Create daily Threat Hunting Process for querying environment utilizing CTIand MITRE Framework.▪ Implement tools into Cyber Portfolio to enable CTI and TH needs.▪ Report directly to the CISO on program status and direction, budget, metrics,and ensure alignment with corporate goals.

Conshohocken, Pa, Us

▪ Created, designed, staffed, and managed Digital Forensic Program▪ Implemented forensic tool set and designed requirements for Forensic Lab▪ Lead investigator from all incidents including Cyber Operations, HR, Legal, andCorporate Security▪ Held weekly training sessions to educate other analysts on forensictechniques and practices▪ Developed relations with other departments and business units to provide anew forensic service enterprise wide▪ Implemented Legal Hold imaging and chain of custody process▪ Created and Implemented Malware Analysis Playbook for Tier 3 analysis.

Conshohocken, Pa, Us

▪ Perform hands-on support for a wide range of security technologies including,but not limited to: SEIM, IDS/IPS, HIDS, malware analysis and protection,content filtering, logical access controls, identity and access management,data loss prevention, firewalls, content filtering technologies and vulnerabilityscanning for over 30,000 machines.▪ Provide project management for security projects and new security tools toinclude evaluation, vendor selection, installation, configuration, tuning, anddocumentation creation▪Serve as a hands-on technical expert working directly with delivery teams toprovide guidance and ensure solutions adhere to security policy and bestpractices.▪ Perform vulnerability management and operating system/application secureconfiguration management and advise engineering teams regarding currentvulnerability and hardening standards.▪ Recommend and perform update of Information Security policies and set outrules for enforcement.▪ Lead investigations of violations of Information Security Policies. Developrecommendations and take appropriate action.▪ Define and provide audit reporting for upper management consumption.▪ Designed, built, managed Security Operation Center▪ Incident Response Lead – gather appropriate resources and personnel tosolve cyber incident in a timely manner, following CSIRP guidelines.▪ Deployed phishing simulations enterprise wide, with appropriate follow uptraining▪Mentored junior staff on security incident investigation, malware analysis, operations, and risk management.•Prepare weekly reports on incidents across all business units to management and executive leadership as required.

Houston, Texas, Us

▪ Project Lead for over 20 phishing campaigns averaging 10,000 e-mailsresulting in over 600 awareness classes taken, and a decrease in average of5% clickrate over campaigns over 558,000 machines.▪ Involved in multiple forensic investigations with critical/sensitive data andsupervised chain of custody and lead investigations.▪ Individually refined IPS/IDS solutions to meet enterprise needs and tunedFirewall rules to reduce false positives in SIEM alerting▪ Analyzed reports from SOC based on network usage and identified anomaliesin real time using ArcSight, Palo Alto, McAfee, and LogRhythm▪ Developed and coded an intranet hosed service catalog containing over 80cyber security related services accessible to over 150,000 employees.▪ PM for “Cyber Security Month” which resulted in over 23,000 page hits, 7,100cyber training course completions, and guest speaker events from the FBI.

Palo Alto, Ca, Us

▪Developed and maintained a “Cyber Threat Intelligence Alert Dashboard” forISO executives using ArcSight, Sharepoint, and Qualys utilizing CTI from ISAC's and OSINT▪ Managed daily security alerts from cyber toolset, working with securityanalysts to validate events and report false positives and initiate properremediation steps for endpoints/servers▪ IR first responder, scoping size of cyber issue, taking proper containmentmeasures and verifying business impact with SME’s.▪ Designed, built, launched, and taught the company’s security awarenesstraining program by developing courses hosted on learning portals, inconjunction with phishing simulations.

Worked with litigation teams to analyze incarcerated individuals petitions of exonerationPrioritized cases based on chances of legitimacy and forensic evidence available

Master Of Science - Ms, Cyber/Computer Forensics And Counterterrorism

Master'S Degree, Computer Forensics

Bachelor'S Degree, Computer/Information Technology Administration And Management

Bachelor'S Degree, Management Information Systems