Christopher Bennett Email & Phone Number

San Francisco, Ca, Us

At Ripple, I serve as a direct advisor to the CISO as the SME on Threat Detection and Response, and as a security generalist for the broader Information Security Team.I. Key Leadership Accomplishments - Partnered with the CISO to define team ownership, create a security strategy, and lead hiring, enhancing capacity and delivering a clear roadmap. - Assessed and optimized D&R tools (SIEM, SOAR), improving detection speed and accuracy. - Consolidated security signals into a single alert channel, optimizing triage and reducing missed alerts. - Established an On-Call Rotation for Security Event Triage and trained engineers for effective response. - Developed a tailored Incident Response Plan, enhancing preparedness and reducing MTTR. - Led Incident Response Tabletops and collaborated with Compliance to remediate issues.II. Key Technical Accomplishments - Built Security Tooling across AWS/Azure/GCP/IBM Clouds, providing complete cloud security visibility and improving detection coverage. - Designed an ETL Pipeline & Security Data Lake, reducing costs and boosting reliability. - Created custom detection rules in Google Chronicle/SecOps SIEM. - Developed automations that accelerated response times and reduced manual work. (i.e. Slack Bots for incident response, phishing remediation, and session revocation) - Deployed Thinkst Cloud Canary devices, enhancing threat detection. - Conducted Security Assessments, creating custom detections for risky behaviors. - Developed a framework to detect adversary domains, scrape malicious cryptocurrency addresses, and enable timely mitigation. - Formed partnerships to share indicators, preventing scams and saving millions. - Engineered a monitoring service for high-value cryptocurrency transactions, cutting response times from hours to minutes.III. Mentored the team in IaC with Terraform, Detection Engineering, Incident Triage, Systems Engineering, and Automation, enhancing their ability to tackle security challenges.

San Francisco, California, Us

● Hired and trained a team of engineers to build out Okta’s Federal Detection and Response Team.● Collaborated extensively across the organization to assess the company’s audit readiness andremediate deficiencies, leading to a successfully “passed” audit and no findings for my team.● Engineered and deployed Detection and Response Processes and Tooling in a challenging,regulated environment - leveraging the assessment to deploy critical security improvementsthroughout the platform environment.

San Francisco, California, Us

General Functions • Pivoted through complex, diverse, time-series event data to provide thoughtful analysis on security incidents and proactive threat hunts • Wrote well-researched, well-engineered, and performant threat detections to raise events of concern to the forefront and meet our reporting requirements • Took part in a team watch rotation, triaging alerts escalated via automated processes, internal reports, and third-party notifications • Actively participated in incident response; contributed to IR process improvement and automation • Wrote, maintained, and bolted on tools to automate/improve all aspects of our data analysis pipeline, from telemetry generation to playbook automation • Performed the Technology/Security Research and Architecture Reviews needed for a thorough understanding of our platform and all acquisitions • Mentored and coached junior employees • Interacted extensively with external teams such as IT and Operations on cross-functional projectsKey Accomplishments • Used entirely open source tooling to generate required security signals in corporate and product environments, to include building out agent configurations for all platforms and building/maintaining backend security infrastructure at scale in AWS. • Matured our security detection program from ad-hoc, unmanaged detections to a serialized, machine-readable, ATT&CK-mapped detection corpus, version controlled in GitHub. • Built and led projects for many critical security tools to improve operations, such as a tool to track/report on dozens of unique data types onboarded into our systems, a custom CI/CD platform for security application testing/deployment, a detection CI/CD platform for automated testing and deployment of detections to SIEM from GitHub, and a tool which automatically alerted our IT team to the absence of security tooling on servers/endpoints. • Served as Principal Engineer in the areas of Data Engineering, Detection Engineering, and Splunk.

Bethesda, Md, Us

In my role in Research and Development for a large Enterprise Blue Team, my job is to solve the toughest Cyber Security challenges alongside my colleagues. This involves tasks such as Information Security Research, Threat Detection Development, Programming of Custom Tools, and Threat Hunting through the many different network types in our enterprise.In this role, I have specialized in automating manual workflows to remove distractions and help analysts focus on the data. I have also served as the Threat Hunting SME on my team, combining community Threat Hunting techniques with my own to teach my team how to find the needle in the haystack, prove/disprove hypotheses, and deal with false positives.Accomplishments in this role: - Design, Development, and Implementation of an enterprise Threat Detection Program - Development of novel Behavioral Analytics for Threat Detection - Creation of multiple custom tools for the extraction and analysis of host forensic data - Development of a prototype Windows EDR Tool utilizing Event Tracing for Windows (ETW)Technologies I have relied upon heavily for my projects: - Programming Languages: C/++/#, Java, Python, PowerShell, Bash - Windows (Registry, API, WMI, WinRM, ETW) - Kali Linux (Metasploit, dirb, nikto) - VMWare ESXi/Fusion, and Docker - Splunk SIEM (Queries/Dashboard/App Development, Administration, SOAR Integration) - Databases (Oracle, MSSQL, Postgres, Mysql/Mariadb, Redis, Mongo, Riak) - Security Monitoring Tools (Sysmon, Procmon, Snort/Suricata, Bro/Zeek, Yara, Wireshark, Tcpdump) - Network Visibility Tools (Nmap, Bloodhound)Models/Resources/Mentors whose work I have implemented and that have enabled my success: - MITRE ATT&CK Matrix, Diamond Model of Intrusion Analysis, Pyramid of Pain - Vendor Blogs/Reporting (CrowdStrike, Mandiant, Red Canary, Endgame, Talos, Project Zero, SpectreOps) - Mentors include Roberto Rodriguez, Matt Graeber, Casey Smith, David Bianco, and Robert M. Lee (and many more!)

Bethesda, Md, Us

• Managed an Industrial Control System network with over 38,000 tag values, 250 Ethernet devices, 9 servers, 20 workstations, and a variety of field controllers• Responded to incidents in order to fault isolate and resolve device failure• Performed server maintenance and troubleshooting, managed user accounts, and served as the Network Security manager for the program• Participated in numerous ICS device installation and upgrade projects, and helped to integrate devices with data historian for data collection and trending.• Managed an IBM Maximo Asset Management installation with over 5000 assets, and generated over 2000 PM work orders per month to drive facilities maintenance operations• Developed custom SQL Queries and BIRT/Crystal reports in order to present trends and other critical data to the Program Manager

Somerset, Pennsylvania, Us

Language support to DoD

Washington, Dc, Us

• Set up and established secure, tactical radio networks using established security practices and cryptographic equipment• Oversaw the operation and ensured high availability of a tactical workstation/server network as well as communications link to headquarters from a remote site• Maintained a language proficiency of 3/3 in the Persian-Afghan (Dari) Language• Analyzed raw intelligence and generated reports based on relevant information• Organized and taught lesson plans on Intelligence Collection and Analysis• Governed the readiness, discipline, and effectiveness of a team of Marines• Tested, Inventoried, and Operated sensitive communications equipment and electronics• Honorable discharge as a Sergeant of Marines

Master Of Science (M.S.), Computer Science

Bachelor Of Science (B.S.), Computer Science

Associate Of Arts (A.A.), Persian-Afghan (Dari)