Daniel Althoff Email & Phone Number

Kingsville, Md, Us

Bethesda, Md, Us

- Federal Information Security Specialist with the NIH- Support CSO with federal budgeting and acquisitions of goods and services- Perform Privacy and Risk Impact Assessments- Led the development of a new NIH wide Incident Response Plan- Develop and implement Table Top exercises with internal and external stakeholder- Develop CSO policies for securing and monitoring Controlled Access Data Repositories- Grow and mentor security operations teams to work cohesively rather than in silos-Define the strategy and roadmap for Cyber Threat Intelligence, Red/Blue Teams and Adversary Emulation, Threat Hunting, Detection Engineering, Digital Forensics, and Security Operations/ Incident Response Services-Provide executive leadership and continuous visibility to new and emerging threats against NIH-Brief executive leadership on emerging security threats and develop proposals on how to address these threats through building security controls and processes-Lead the construction and implementation of an industry leading Security Operations, Incident Response, and Threat Hunting Programs-Lead security incident and data breach investigations and handling Executive Summary and post-incident reporting in urgent or critical situations-Partner with cybersecurity peer directors to identify opportunities to strengthen maturity CSO and Fusion capabilities

Bethesda, Md, Us

- Began as a Contractor Lead with Edgewater Federal Solutions for the Detection Engineering Team at NIH, then transitioned to the Cyber Security Operations Center Deputy Task Lead, overseeing all Sub-Divisions; Red Team, Threat Hunt, Detection Engineering, Cyber Threat Intelligence, Forensics, and Analysts. - After working as a contract lead, I was hired full time as a direct Federal Employee lead.

Hawthorne, California, Us

- Analyze and respond to endpoint, network, and emerging threats in our environment- Work closely with Proofpoint for analyzing and responding to email security threats- Work with the Insider Threat team to provide comprehensive alerts and dashboards using Splunk- Work with the Assurance team to provide SOC evidence collection and documentation to achieve PCI accreditation, along with ISO-27001, and meet NIST 800-53 standards- Implemented a Cloud Detection Standard/ Catalog to standardize detections across Azure, GCP, and AWS- Lead comprehensive table top exercises - Work with compromised vendors to remediate issues where vendors are compromised, to ensure the security of SpaceX data- Develop new detections with Splunk SPL- Work with Insider Threat team for new content development and Insider threat investigations

Mclean, Va, Us

• Build Threat Detection Alerts within Splunk and Supporting EDR Tools• Conduct Adversary emulation and simulation exercises• Conduct MITRE ATT&CK Framework assessments • Migrate Alerts to Detection as Code• Work Closely with the Investigations Team to integrate tools and security content for higher fidelity alerting• Develop Machine learning based alerts for higher fidelity alerting to reduce false positive events• Administer SentinelOne for endpoint detection• Utilize SentinelOne’s Deep Visibility Engine to create endpoint based alerts aligned to the MITRE ATT&CK framework in ID.me’s corporate environment• Serve as an Incident Response escalation point for all internal and external threat investigations• Conduct event analysis and triage of higher criticality security alerts• Lead monthly Threat Hunts within the Environment• Work with the GRC team to collect evidence for FedRAMP assessments• Implement high fidelity alerting for targeted investigations and threat hunts• Develop Incident Response playbooks and procedures for security incidents• Support incident response activities to include host-based forensics and containment strategies• Architected and built the Splunk FedRAMP environment• Enhance Splunk Enterprise Security Administration for both FedRAMP and Corporate Infrastructures- Develop insider threat detections based on user behavior and data analytics

Greenwood Village, Co, Us

• Led an 85% growth of revenue for SIEM Engineering engagements from 2018-2020.• Led a 3.25 X multiple of professional services projects for SIEM Engineering engagements from 2018-2020• Designed and implemented SIEM architectures for security best practices and compliance framework requirements• Built Splunk and other SIEM environments to meet the standards of NIST 800-53, 800-171, CMMC, and FedRAMP Compliance Architectures• Developed Security Monitoring and Threat Analytics content• Hand’s-On technical leadership of Security Operation’s SIEM Team in a “player/coach” role • Wrote and standardized legal Contracts and SOW's for client engagements• Performed FedRAMP Architecture Gap Analysis• Programs Created and Lead: o SIEM Threat and Vulnerability Management o Risk Analytics CVSS Re-Scoring o SIEM Professional Servers (Splunk and ELK) o SIEM Compliance and Best Practice’s Workshops o SIEM Purple Team Workshops o Elastic Stack Application development for NIST, FedRAMP, CMMC, and Security Best Practices o Splunk application development for NIST, FedRAMP, and Security Best Practices• Integrated SIEM Engineering Professional services team with other engineering team’s: o Accelerated Cloud Engineering o Threat and Vulnerability Management o Penetration Testing Team o Cloud Advisory o Compliance Advisory o Cloud Managed Services• Lead Architect to design and build SIEM tools such as Splunk, McAfee ESM, and the Elastic Stack based on client needs and compliance framework requirements

Denver, Colorado, Us

- Began as a SIEM engineer providing first responder technical support for Splunk platform issues. Worked my way up to a Senior Splunk Engineer.- Responsible for Platform Management and Platform Currency of Splunk Enterprise and Enterprise Security products, including upgrades to apps and Splunk Core-Primary point of contact for assisting MSS clients in data and log ingestion for Splunk Enterprise and Enterprise Security products-Responsible for maintaining backups of all client’s Splunk environments for disaster recovery-Advise clients to recommendations on upgrades of Splunk software, as well as Hardware for Splunk app and platform installations-Work directly with the content and Threat Analysis Team with on-boarding new Splunk MSS clients for tailored Log Source and data ingestion to build reliable Security alerts and content- Work directly with on-boarding new Splunk MSS clients in setting up Health Checks for Splunk server software and hardware monitoring-Work directly with clients on designing the architecture of a Splunk Distributed Deployment-Set up, design, and deploy Splunk Indexer and Search Head Clusters for complex distributed deployments-Work directly with clients on index modifications for retention time and volume size, as well as index migrations between hot/warm and cold volumes.-Act as a point of escalation for Tier 1 and Tier 2 Engineers-Provide remote consulting services via interactive client sessions to assist with troubleshooting of Splunk servers, as well as the upgrade process for Splunk apps and Splunk servers-Configure custom Splunk apps and products to meet MSS client needs, based on available data and log sources

Denver, Colorado, Us

-Analyze, document and report on potential security incidents identified in customer environments-IDS/IPS monitoring and analysis for SourceFire and FireEye-SIEM monitoring and analysis for QRadar, Splunk, Nitro, LogRhythm, and Arcsight-Work with partners to maintain an understanding of security threats, vulnerabilities, and exploits that could impact systems, networks, and assets-Act as a coordinator for security events that require urgent response, containment and remediation-Provide analysis on various security enforcement technologies including, but not limited to SIEM, antivirus, content filtering/reporting, malware prevention, firewalls, intrusion detection systems, web application firewalls, messaging security platforms, vulnerability scanners etc.-Perform knowledge transfers, document and train clients regarding mitigation of identified security threats and vulnerabilities-Provide ongoing recommendations to other MSS peers and customers on tuning and best practices-Prioritize and differentiate between potential intrusion attempts, determination of false alarms, insider threat and APT detection, as well as malware analysis/forensics.-Provide knowledge and understanding of contemporary security architectures/devices, such as firewalls, routers, switches, load balancers, remote access technologies, anti-malware, SIEM and AV-Actively research current threats and attack vectors being exploited in the wild-Create Standard Operating Procedures for how to perform Threat Analysis on specific alerts-Work with engineers to create new content rules for SIEM alerts-Quality Check junior analyst’s escalations and analysis work

Nottingham, Maryland, Us

-Primary Administrator for McAfee ePolicy Orchestrator and applications such as; McAfee Agents, Host Intrusion Prevention System, Virus Scan Enterprise for Mac, Virus Scan Enterprise for Windows. -Perform Monthly Wireless and McAfee Security Audits, Quarterly User Audits, and Annual PCI compliance audits -Analyze and assess vulnerabilities in EZShield’s software, hardware, and network infrastructure through McAfee ePolicy Orchestrator -Analyze and assess damage to data/ infrastructure as a result of security incidents -Configured and Administered DUO Multifactor Authentication access controls for VPN access - Configured and Administered off Site application authentication with Okta SSO -Manage and troubleshoot the backups of all end users and servers with Mozy Enterprise, CloudBerry Lab, and Local Netapp storage -Configure new applications for Single Sign-On in Okta including SAML federation and SWA integration

Master Of Science (M.S.), Cyber Security

Bachelor Of Arts (B.A.), History