David Batzer Email & Phone Number

The Cyber Security Incident Analyst role is responsible for in-depth analysis of security events discovered by the Event Analyst. After detection, an Incident Analyst must be able to apply his/her experience and expertise in various system and networking technologies to determine if an incident has occurred. If an incident has occurred, the Incident Analyst will follow detailed operational process and procedures to escalate and assist in gathering of evidence for information security incidents. Additionally, the Incident Analyst will serve as a shift lead to provide in-depth analysis, escalation and call-outs, and mentor the Event Analyst.The Incident Analyst will be asked to perform the following major tasks:Provide 24x7 monitoring of information security events.Research various security events using his/her knowledge, research tools, and threat intelligence to determine when an incident has occurred.Analyze “sweeps” the IT environment looking for indicators of compromise.Follow detailed operational process and procedures to appropriately triage, analyze, and escalate critical information security event.Consume threat intelligence to proactively detect threats to the GM IT infrastructure.

Detroit, Mi, Us

The Cyber Security Hunter position at Ally is a member of the Information Protection and Risk Management team and works closely with other members of the IPRM program to develop and implement a comprehensive approach to the management of security risks at Ally. The Cyber Security Hunter will search for malicious activity across the enterprise, analyze data from a variety of security tools and sources, as well as recommend counter-measures. This role will participate in leading the Security Incident Response process and serve as an escalation point for higher severity incidents. Detect, identify, and understand an advanced and determined threat agentCollaborate with the SOC and CSIRT teams to develop and implement approaches to monitor and prevent attackers.Propose additional components and techniques that could be used to proactively detect and prevent malicious activity.Assist in leading investigation of information security incidents.Perform complex security investigations and root cause analyses.Supervise incident handling & response activities and assist SOC supervisor with day-to-day operations as needed.Assist with managing identification, containment, eradication, & recovery of larger incidents.

Midland, Michigan, Us

Work with senior I/S security managers to enhance monitoring and incident response capabilities, provide incident support as needed, and analyze data.• Develop and implement new alerts using the SIEM, Application whitelisting, or network Security Analytics systems.• Query logs in several security products for IOCs from various sources (such as government and industry reports, internally developed IOCs, etc), eliminate false positives, and remediate as needed. • Analyze suspicious emails, determine intent, and gather malware from phishing attacks. • Analyze malware in various sandboxing tools to gather IOCs for further investigation.• Support security investigations, incident response, and security compliance initiatives by doing data mining, data analysis, and creating new alerts and monitoring as needed in many various security tools. • Use Network packet capture data and network analytics tools to analyze events, export PCAPs, and draw conclusions.• Develop new procedures for, and train, level 1 and level 2 SOC team members.• Big data analysis: gather data and compile reports associated with security-related initiatives, and draw conclusions from data (data such as virus infections, security groups, or network traffic, for example). • Receive escalations from Level 1 SOC team regarding trend changes (such as an increase in a certain type of infection or a high amount of failed logins from a user) and investigate.

Midland, Michigan, Us

Function as a run-the-business VMS system administrator, daily and on-call as needed, while also upskilling 1st level VMS support to become 2nd level support. • Create new scripts and procedures for VMS Level 2 support, using Wiki and Sharepoint software. • Implement run-the-business changes through change management process. • Volunteered for additional work on Office365 project from October 2011 to present: facilitating the transition from Level 2 project support to steady-state support. • Oct 2011- October 2012 – added Level 2 Office365 support, including on-call. Active Directory and Exchange-related end-user support; submitting problem tickets to Microsoft.

Troy, Michigan, Us

Reboot systems, file restores, client tickets, dispatching incident calls, creating documentation and procedures

University Center, Mi, Us

Assisting students with computer use and problems; phone troubleshooting help for students using Delta College Michnet dial-up internet access.

Bachelor Of Arts (B.A.), History

Education record