• Led the implementation of a comprehensive Security Operations program from scratch, enabling 24/7 monitoring of critical infrastructure, applications, endpoints, and vulnerabilities. This program reduced overall security risks by over 30%.• Championed early and continuous security integration throughout the application development process, resulting in over 150 successful deployments with zero security incidents.• Fostered a culture of shared responsibility for application security, resulting in an 80% reduction in post-production vulnerabilities.• Directed the execution of security risk assessments and conducts related ongoing compliance monitoring activities; supported the firm through successful acquisition of SOC1 Type 1 certification.• Engaged with business leaders and corporate functions such as legal, HR, product development, and IT to support security of the business data and products, ensuring a positive, cross-functional approach and culture for security is shared among teams.• Acted as a mentor for multiple colleagues in different business units on career development and technical skills.• Founding member of company Culture Club; championed company culture through social event planning and recommendations for positive change to Company Senior Leadership Team.

• Managed a team of 7 full-time analysts and engineers responsible for monitoring, triaging, investigating, containing, and remediating security-relevant events across a global hybrid cloud environment.• Authored technical career ladder for Security Operations which resulted in a high level of transparency into role leveling and the setting of expectations.• Built and maintained many cross-functional relationships with key business partners, stakeholders, and vendors.• Contributed heavily to the development of a metrics program for Security Operations, resulting in a highly robust set of metrics describing the state of operational security.• Developed guidelines for determining the most effective use of automation and measuring the business value of those automations.• Designed and implemented multiple new processes, procedure improvements, guidelines, and frameworks.o Ticket review/QA processo Unassigned alert queueo Investigation guidelineso Career development framework• Acted as incident commander for critical severity, business-impacting incidents.

• Defined and led multiple major security initiatives.o Two-Factor Authentication (2FA) for VPN authentication across organizationo Enterprise Password Management programo Corporate/AWS VPC implementation with Active Directory• Developed and implemented company Information Security Policy and Incident Response Plan.• Defined metrics to assess operational effectiveness of Information Security operations, security posture of the organization, and level of impact to the organization related to the Information Security program.• Designed and implemented secure cloud architecture for scalable deployment of custom email security platform.• Designed, built, and secured development and production zones in Amazon Web Services (AWS).

• Managed deployment, configuration, tuning, and operation of global network intrusion prevention system as well as Endpoint Detection and Response (EDR) platform.• Built email automation using Google Apps Script for mass user notifications, reducing time required for 500 notifications from 12 hours to 30 seconds.• Defined and documented information security processes and procedures for operational readiness of the Cyber Defense Operations Center.• Redesigned in-house alert system within the Splunk ecosystem to create meaningful and actionable alerting.• Briefed Senior Director and CISO on a periodic basis regarding high and critical severity incidents.Created metrics relevant to the state of operational security.

• Managed multi-tier team of 22 operators/analysts, including full-time employees and contract resources.• Built external partnerships. Work with Intel’s Chief Security Architect led to eBay’s contributions to Open Network Insight (ONI), an open-source project later donated to the Apache Foundation as SPOT.• Provided daily incident briefs to company Officers/Vice Presidents to maintain focus on the current security posture of the company.• Provided coaching and performance management to junior team members, three of whom were rewarded, recognized, or promoted by Security Management within a 6-month span.• Regularly reassessed strategic goals and tactical activities to aid in roadmap creation and planning commitments for Global Information Security. • Managed playbooks for high and critical incidents.

• Managed multiple use case developers• Architected a new generation of Splunk-based alerts, updating more than 200 legacy use cases which evolved the CSIRT from basic event triage to tracking actionable and measurable security incidents within 6 months.• Used proactive hunting techniques using both Splunk and in-house EDR platform to identify suspicious activity not being detected by the security stack and developed new use cases to detect the activity.

• Performed malware analysis and reverse-engineering to extract Indicators of Compromise (IOCs).• Built and maintained centralized IOC library.• Developed Python-based automation for analyzing value of various threat intelligence items.• Performed incident response functions as required.

• Incident responder for events ranging from commodity malware infections to Advanced Persistent Threats.• Built a phishing response automation tool.• Performed malware analysis and reverse engineering to extract IOCs.