Carl Hester Email & Phone Number

San Francisco, California, Us

* Designed, built, and managed custom software and infrastructure for supporting securityinitiatives* Led the technical implementation of automation tooling used to inspect, report, and implementsecurity configuration requirements across an AWS fleet of 2K+ accounts* Implemented a static code analysis, secrets identification, and reporting capabilities acrossinternal code repositories* Supported internal authentication, authorization, and secrets management tooling* Developed on AWS Lambda, ECS, Fargate, EC2, S3, etc... using Golang and Typescript CDK,Cloudformation, and Terraform

San Francisco, California, Us

* Led security incident response activities in daily and on-call rotations through detection,investigation, handling, mitigation, remediation and post mortem activities* Coordinated with Twitch and AWS executive leadership, legal counsel, and other stakeholders onmultiple high profile incidents* Continuously improved security incident response operational procedures* Deployed and managed network and endpoint detection and investigation capabilities* Developed and published internal policies and standards related to security incident response,data investigations and access revocation* Served as technical SME for litigation against platform abuse filings

Chicago, Il, Us

• Research and analysis of existing and fundamental technical capabilities to identify improvements, gaps, resource investment priorities and enhancements to service• Research and analysis of emerging technologies, investment opportunities, start-up technologies and innovative approaches to security and technical problems • Advise leadership on technical capabilities, solutions, endeavors, demos, proof of concept evaluations and discussions• Assist in developing and implementing strategic goals and objectives• Identify opportunities for implementing proactive security practices• Support the development of Security Engineering resources to provide management or oversight of security technologies • Work alongside technical security teams to identify synergies • Improve communication and coordination amongst technical staff• Critically evaluate coverage gaps and determine appropriate mitigations • Analyze and identify processes where automation may be implemented for improved efficiency and accuracy of results• Act as security liaison for projects and efforts in compliment to security architecture• Work with Security Analysis and CyberSOC to improve coordination and collaboration of threat intelligence• Support development of cyber threat modeling program

Chicago, Il, Us

Manager for high performance Network Security Monitoring, Incident Response, Threat Intelligence and Digital Forensics team in Fortune 150 Energy Company. • Built and managed team of fourteen NSM, Threat Intel and DFIR analysts in daily operations. • Managed incidents of varying severity through research, detection, escalation, response and remediation. • Identified and implemented strategies to improve capabilities and performance of CSOC team. • Managed procedures to meet NERC Critical Infrastructure Protection (CIP) compliance. • Created monthly and annual reports on metrics, achievements, challenges and initiatives. • Designed and implemented processes for repeatable and measurable security operations.• Identify and invest in high value technologies to support CSOC mission. • Provide challenging and diverse environment for continuous improvement and advancement.

Chicago, Il, Us

• Designed and implemented tools and processes for intelligence focused security operations including significantly improving the time and effort required to query for IOCs in historical data. Moved flat file logging data to database system, which allowed for querying one year of data in less than one second drastically improving ability to hunt for IOCs. • Leveraged a custom suite of Open Source Linux tools to provide robust security monitoring capabilities • Analyzed malware and performed host and network forensics as part of incident response. • Worked closely with FBI, US-CERT, ICS-CERT, and other government agencies for identification and reporting of attacks against US Critical Infrastructure• Designed and maintained incident tracking system to support threat trending, metric reporting and performance measurements. • Designed, created and facilitated IT tabletop drill which simulated activities of advanced threat actors with the intent of interrupting electric control systems. • Designed and facilitated both tabletop and technical drills for CIRT team members• Created and presented multiple security awareness presentations for IT and non-IT audiences on topics such as “Exploit Kits”, “Malware Techniques and Tactics”, “Malware Persistence”, “Recognizing Malicious Emails” and “Handling of Forensic Evidence.” • Adopted Lockheed Martin “Attacker Kill-Chain” methodology to intelligence and incident identification and response.• Developed custom tools and scripts and to help facilitate and automate analysis and response capabilities. • Designed tiered security operations model and identified roles. Built processes and workflows to support operational tasks including escalation of security incidents. • SME for network security monitoring, SIEM and incident response for North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) procedures and audits

IT Consulting services

Lead Consultant for medium and large client engagements and Technical Lead of four consultants across multiple client sites.• Deployed and managed Firewall, IDS, and Vulnerability management security architecture for multiple medium and enterprise clients in MD and VA. • Performed NSM, Incident Handling and operational management of security architecture. • Provided guidance on technology selection, requirements gathering, and engineering for IT projects, assessments and deployments• Managed daily duties and responsibilities of four secondary consultants in various IT and Security roles

Falls Church, Va, Us

Team lead on various network engineering projects.

Upper Marlboro, Md, Us

Contracted to rebuild and deploy HP Openview Network Node Manager to provide infrastructure monitoring.

Managed tier I and escalated support tickets.