Daniel M. Email & Phone Number

Enterprise Security Engineering • Automation - Creating Python scripts linked to APIs for AWS, First Base, Kandji, Tanium, Carbon Black, Tenable, Jira, and Slack.• AWS / Terraform – Modified and created IAM objects, permissions, and references via Terraform.• Incident Response – Responding to incidents, collecting threat data, identifying root causes, reviewing and closing misconfiguration gaps, writing formal reports, and communicating to stakeholders. • Panther (SIEM) – Reviewing and filtering alerts, utilizing SQL for data presentation. • Google Workspace – Responding to incidents and overhauling configuration refinement.• Elasticsearch and Grafana (SIEM) – Created fully custom dashboards, alerts, and queries. • Carbon Black (AV) – Configuring policies, responding to alerts, and excluding false positives from watch lists. • Prisma Access (SASE) – Reviewing, approving, and recommending firewall implementations, troubleshooting end user issues. • Tanium (MDM) – Led RFP engagement to purchase, acting as secondary for deployments and patches. Studying Tanium Essentials course. • Secureworks (MSSP) – Coordinating with SOC agents and account management, defining alerts, threat hunting, utilizing their SIEM tooling. • Flashpoint (OSINT) – Led RFP engagement to purchase, gathered and presented threat intel reports, established and investigated alerts, pitched further tooling to stakeholders. • Further hands on and input with Okta, Tenable, Kandji, Airwatch, Jira, Confluence, First Base, TeamViewer, and many other tools. Project Management and Leadership • Presented team progress and planning a C-level tech committee. • Oversaw, organized, and provided input to multi-team projects, ensuring timely and thorough completion. • Took on a leadership style role in the long absence of a manager, leading conversations and decisions on critical matters while empowering colleagues to provide their own input and become the best version of themselves.

Lehi, Ut

Splunk Enterprise Security / Splunk Enterprise• Passed Splunk Enterprise Security Admin certification.• Converting logs to CIM format.• Configuring correlation searches.• Customizing dashboards with Splunk and Regex code.• Architecting user roles and restrictions across apps, groups, and servers.• Assisting with data ingestion.• Installed and deployed applications in a distributed instance.Mimecast• Involved in most initial troubleshooting since deployment.• Configuring numerous policies and suggesting best practices.• Monitored critical emails, releasing numerous emails until I could successfully pass moderating over to corresponding teams.Sophos• Configuring all user, computer, and server policies.• Writing documentation for the SOC and presenting in training sessions.• Created a network diagram for the Update Cache and Message Relay.• Successfully pushed for the Endpoint Detection Response add-on.Okta• Configuring SAML/SSO within Okta and corresponding applications.• Managing users and groups.• Configured policies.Auditing• Weekly reviewing US Cert notifications for vulnerability management.• Performed quarterly access audits on Active Directory, Okta, badge systems, internal applications, etc.• Providing suggestive configuration changes across various applications and teams.Documentation• Handling numerous questionnaires from various vendors.• Creating Knowledge Base articles for anything Security related, especially in building out the SOC team.Other• Heavily involved in SOC buildout for setting roles, dashboards, alerts across applications, including training with accompanying Knowledge Base articles.• Known for willingness to 'jump into things' to learn, assist, and manage, even if I don't have any previous experience.• Attended Splunk .conf18, Blackhat, Defcon, Bsides SLC.• Studying AWS Cloud Practitioner certification.

Draper, Ut

Network Security• ACL Changes - Evaluated network requests for approval/denial.• Firewall Review – Manually analyzed extensive rules to provide recommendations for security improvements and cleanup.• AD Security Groups - Architected groups for application access.Application Administration• FortiGate UTM – Applied IDS and AV passively through Gigamon net-work tap and aggregator, applied AD security groups, implemented un-used features and evaluated for optimal effectiveness.• Splunk SIEM – Defined potential logs for ingestion against tight budget constraints and prepared use cases. Attended .conf2017.• Firemon - Spearheaded configuration and POC presentation. • Acted as secondary admin for Carbon Black Defense, SEP Manager, Symantec DLP, and Tenable Nessus. SEP Manager, Triton DLP, and other related duties were handled as primary admin before Lanyon-Cvent merger. Incident Handling• Wrote policies and provided suggestions for standalone and corporate devices in response to higher level incidents.

Draper, Ut

Windows Server 2008-2012 R2• Active Directory – Initial domain configuration, Group Policy, PowerShell, security groups, org units, full account administration, etc.• WSUS – Deploying updates, uninstalling updates, test groups, utilizing Group Policy for OU targeting.• WDS with MDT – Creating deployable images with applications, drivers, and updates.• GPO, DHCP, DNS, NPS, Print, DFS, FSRM, File shares, VPN, Direct Access, and other knowledge is currently being practiced and obtained through studies at PluralSight.com.Office 365• Administrating accounts and distribution lists through PowerShell and the UI.• Restoring mailboxes via discovery/litigation hold• Knowledge of DirSyncMac Server• NetRestore – Creating deployable snapshot images through System Image Utility.• OpenDirectory – Integration with Active Directory, Device Management, and Profile Manager. PowerShell Scripting• Completed automation of multiple scripts, including onboarding and offboarding processes within Active Directory and Office 365• Frequent use of CSV files to perform bulk actions Knowledgebase Administration• Modified Handlebar.js and CSS code for the page’s design without previous experience.• Writing, revising, and reviewing all support articles from the Desktop Support team, including having published 42+ support articles to the KB and many others for internal support. MoreProviding 2nd and 3rd level administrative and hardware support for 65+ onsite and 550+ remote employees.• Administrating Symantec Manager, TRITON DLP, and MaaS360• Repairing Mac and Windows computer hardware and Operating Systems.• Providing support on virtually any application, whether standard or non-standard to the company, including MS Office, WebEx, web browsers, etc.• Acting as POC for network outages and maintenance in coordinance with level 3 engineers.• Managing Masergy VoIP phones and admin console.• POC for hardware setup and repair for projectors, monitors, IP phones, etc.

Draper, Ut

Supported 6 client companies in Helpdesk duties via phone and email: Teradata, Greatbatch, OPower, Argo, iCore, RSGGained strong experience in MS Office, WebEx, Windows OS, Mac OS, telephony, networking, AD, mobile phones, web browsers, drivers, malware remediation, backups, etc.Informally recognized by client for quickly becoming a “pillar” to their support

Draper, Ut

Provided technical and order support on behalf of Blurb

La Puente, Ca