Charles Pfaff Email & Phone Number

Rochester, Mi, Us

Detroit, Michigan, Us

Lead Incident Response team of Incident Handlers from validation and scoping to post incident lessons learned and content creation.• Lead IT security improvements across GM, by overseeing incident response• Oversee the Response team actions during the validation, scoping and containment of an incident• Effectively lead response needs and requirements relating to host activity, network traffic, log management, and cloud provider technologies• Perform post incident coordination of gaps, challenges, and reporting• Build and sustain a collaborative relationship across the company• Generate metrics and reporting functions that highlight gaps

Detroit, Michigan, Us

Lead a highly skilled team of Offensive Security Engineers that focus on full simulation of all adversary tactics to help build detection for known and unknown threats. • Deep understanding of adversaries and their tools• Complete adversary emulation engagements that provide real life assessment of security posture• Foster the ability to leverage well know attacks tools• Deep understanding and application of NIST, Mitre ATT@CK, and Cyber Killchain models• Creation and validation of Detection capabilities within the enterprise• Work directly with Cyber Detect and Response teams• Coordinate Purple team assessments with all teams

Detroit, Michigan, Us

Lead a highly skilled tactical team of threat analysts responsible the detecting threats within the organization.• Deep understanding and application of NIST, Mitre ATT@CK, and Cyber Killchain models• Drive custom detection rules utilizing Bro, Suricata, ELK, and correlation tools • Community focus providing rules relating to Host and Network based detections• Own, develop, and operationalize enterprise phishing detection capabilities• Creation of Cyber Detection Development and training program• Development of host based detection capabilities• Internal Red Team collaboration to test and build new detection capabilities• Purple team engagement to close potential gaps in detection• Investigative platforms Sguil, ELK, Stealthwatch, Microsoft ATP, Arcsight SEIM, IBM QRadar• Build and foster internal job shadow program

Detroit, Michigan, Us

• Initial build of all Cyber tools - Jabber, Wiki, Artifact storage, all others• Built out Linux based Live Response and analysis • Built internal Team LR training • Custom built Python scripting tools• Initial IOC process and operationalizing• Build API functionality across many tools• Custom Suricata, Sguil Network Security Monitoring sensor build• Incident Handing and Triage of Events• Threat Hunting • Perform log-centric analysis (application logs,operating system events, authentication data)• Experience in extracting and correlating largedata sets (Elastic Stack, Splunk, ArcSight)• Experience with endpoint detection and response (EDR) technology (Tanium, CarbonBlack, Falcon, etc.)• Experience using forensics applications and other host basedtools (file, memory, and disk analyzers)

Boston, Ma, Us

• Team engagement lead for spear phishing, breach simulation, and opportunistic attackers• Exploit development• Windows pre/post exploitation• Linux pre/post exploitation• Redesigned team remote attack platform that contains multiple virtual systems on bootable media• Aided in the implementation of red team metrics• Designed team hiring challenge and participated in the hiring process• Built custom tools that aided in meeting engagement objectives as well as future engagements• Off the shelf pentesting tool knowledge including all major vendors

Boston, Ma, Us

• Conducted red team engagements involving adversary simulation to determine if flaws and exposures can be exploited• Help ensure that defensive tactics and technologies are implemented properly • Reverse engineering, artifact analysis, countermeasure development, and APT incident support

Livonia, Mi, Us

Provide network and security services to RS Electronics.Headed network security and design for RS Electronics• Incident response lead• Ground up Network Architect • Managed 13 snort based NSM sensors• Developed and deployed security auditing measures• Designed and implemented secure windows active directory domain architecture.• Deployed Splunk for organization for all firewall, server and workstation logs• Installation and maintenance of Cisco routers , PIX firewall , and frame relay• Deployed client and client less VPN solutions • Architect site mail and mail relay servers