Christopher Witter Email & Phone Number

San Francisco, California, Us

Stockholm, Stockholm County, Se

Global Detection and Response leader responsible for the strategic vision and tactical execution of Spotify’s Detection, Incident Response, and Threat Intelligence programs for the cloud (Azure, AWS, GCP) and enterprise environments (MacOS, Windows, Linux).

Paris, France, Fr

Re-envisioned the entire technical delivery of the Managed Detection and Response program. Developed a multi-vendor Threat Hunting program, collaborating extensively with our threat intelligence team for relevant use cases based on customer verticals. Performed an EDR platform evaluation and bake-off prior to replacing our incumbent partner. Redesigned our entire data pipeline to “free” our data from proprietary formats allowing additional tools, analytical processes, and capabilities to be added to our services. Replaced our incumbent multi-tenant SIEM technology stack increasing performance and capabilities all with no downtime or customer impact. Implemented a Security Orchestration Automation and Response (SOAR) platform increasing analyst efficiencies (>30%) while enhancing the customer experience. Responsible for ensuring technologies, services, and infrastructure (onprem\cloud) are compliant with multiple security and compliance frameworks (NIST, CFIUS). Assumed the role of strategic leader for Detection Engineering, Threat Hunting, Infrastructure Engineering, SIEM Engineering, Insider Threat, and Application Research and Enablement teams.

Remote, Us

Strategic leader responsible for the high performing, extremely efficient, and ruthlessly effective Global Falcon OverWatch Threat Hunting service. Grew our massively scalable operations to 93 billion events a day, by driving analyst efficiencies, utilizing intelligent automations, creating custom tooling, and ensuring supporting infrastructure was capable. Introduced the MITRE ATT&CK framework into the OverWatch team’s threat intelligence collections and reporting, an industry first at the time. Led teams to significant technological achievements: a team of intrusion analysts applied for multiple patent applications and an R&D team developed a ML model which reduced analyst workload by 85% with 0% false negatives. Collaborated extensively with internal threat intelligence and professional services teams extending the reach of our capabilities, unifying our collective approaches, and sharing our findings\tools\workflows. Hired, retained, and mentored an entirely remote international (APAC, EMEA, US) team of research and development, threat intelligence, and intrusion analysts.

Remote, Us

Founding team member Falcon OverWatch (Threat Hunting). Performed email, DNS, and endpoint telemetry analysis for targeted intrusion investigations. Principal Phishing analyst and product owner for Falcon Email (Phishing detection). Falcon DNS (DNS prevention) product owner.

London, Gb

Incident Response, e-discovery, forensics, malware analysis, and threat and vulnerability management lead.

New York, Ny, Us

Founding team member for internal Computer Security Incident Response Team (CSIRT). Principal network and disk forensics lead, responsible for Advanced Persistent threat (APT) case investigations.

New York, Ny, Us

Responsible for performance, protocol, and black box testing of industry’s first 10 gigabit HAIPE encryptor.

Philadelphia, Pa, Us

Arlington, Va, Us

Subject matter expert responsible for creating outside of the box solutions for military\government customers based on open source, commercial off the shelf technology, entirely custom solutions, as well as bleeding edge technologies(non-public). Technologies extensively used: Firewalls, Intrusion Detection, Wireless, WiMax, Satellite Internet Connectivity, Network Encryption, Voice Over IP, MANET (Mobile Ad-hoc Networking) and Full Packet Capture technologies.

International IT consultant living and working in EMEA supporting Cisco Systems. Operated as a SME (1 of 27 worldwide) to support Cisco’s carrier grade SS7 \ VoIP solution replacing Nortel DMS-100 local exchange switches. Consultant on AT&T managed services test and turn up team: performed troubleshooting, upgrades, and Move, Add, Changes (MACs) for customer sites on managed Frame Relay, ATM, and MPLS networks.

Small to medium business IT consulting on Windows NT. Voice over IP phone systems consulting and integration. Acted as the principal Internet Information Server website security administrator for a global pharmaceutical company.

Small to medium business IT consulting. Windows NT, Novell Netware, Microsoft Exchange, installation, support, and administration.Token Ring, 10base2, and Ethernet network installation, support, and administration.

Developed and administered Windows NT and Internet Information Server(IIS) training, certification, and lab exercises.

Small business consulting:- Windows, DOS, Novell Netware, Networking (10base2 & Ethernet)