Richard Castro Email & Phone Number

Led the creation of a SOP for configuring hardware tokens and initiated meetings to provide live assistance, offering clear instructions for a team of 15 to enhance authentication and security measures.Created an SOP for onboarding vendors, reducing SLA by 50% and managing approximately 7 new vendors per month, while also managing documentation and facilitating internal and external audit operations for SOC2 Type 2, PCI-DSS, ISO 27001, and NIST 800-53 compliance.Monitors network traffic for anomalous activity, such as risky user sign-ins, potential communication to malicious IP addresses, DLP, data exfiltration, and unusual software installations, resulting in the identification and mitigation of over 20 security incidents daily.Enhanced the inbound anti-spam filter policy by integrating additional email addresses, achieving a 73% reduction in spam traffic.

Leveraged Wiz to assess and improve cloud security posture, addressing vulnerabilities and misconfigurationDeveloped and optimized KQL queries to create visualizations and gather actionable metrics on domain visits, enhancing monitoring capabilities and providing insights into network traffic patterns.Conducted deep-dive investigations for escalated alerts, handling Tier 2 tasks, including incident response with Azure Sentinel, Splnuk, Crowdstrike Falcon, Wiz, and TrellixCollaborated with the incident response team to ensure swift and thorough containment and mitigation of security threats, experienced in SNOW escalations and documentationHelped client refine their incident response processes and helped train their newly onboarded CERT team

Cyberwox Academy Community Moderator

Triage and investigate malware and phishing alerts from multiple different case managementplatform sources and tools (Jira, Wazuh, Crowdstrike Falcon, Alien Vault, SentinelOne, Microsoft 365Defender). Identified if the alert is benign, suspicious, malicious, and if any remediation actionsneeded to be taken.Monitored network traffic for anomalous activity, such as risky user sign-ins for users, potential communication to malicious IP addresses, DLP, data exfiltration, and unusual software being run or installed.Responded to security incidents and conducted targeted reviews of suspect areas using internal and third-party monitoring tools to identify and resolve root causes of security-related problems.Documented and tracked incidents, providing comprehensive information on event history, status, and potential impact for management and team awareness.