Developed/debugged a variety of use cases in Windows Minifilter driver and platform-neutral usermode code.

Developed Data Loss Prevention document scanning features, interfacing with File MiniFilter Driver for real-time state-keeping and unimpeded scanning access. Involved sophisticated user/kernel handshake interfacing with 3rd party document parsing SDKs and open source libraries and reverse-engineering document formats.

Writing tests (user and kernel mode) and product bug fixes in Windows Kernel drivers used across Antivirus, Endpoint Data/Response, and other computer security-related products.

Writing testware for core Windows Kernel components used across the Antivirus and computer security-related products.

Have invested in the following books for study, Kernel debugging lab experiments, and development a small portfolio of example drivers.-- Windows Internals 6th edition parts 1 and 2-- Programming the Microsoft Windows Driver ModelMade numerous posts here in LinkedIn detailing my learning experience, culminating in a driver and example app that tracks all write/delete file access attempts across the system and allows the user to click Yes to allow or No to preemptively block the access with Access Denied.

Designed and developed in C++ an advanced agent-facing malware removal tool.Early adopter of agile/scrum, using Confluence Wiki and JIRA at Symantec.Key player in the discovery and inital triage of threats such as Backdoor.Tidserv!gen2 and !gen3, Trojan.ZeroAccess, (32-bit and 64-bit), Backdoor.Necurs, Trojan.Poweliks, Trojan.Ransomlock.GDeveloped detection and/or countermeasures for various threats that used exploits such as API Hooks, Permissions exploits, Infected O/S Files (esp. DLLs)Researched and developed technique for providing live remote assistance on rescue platforms where Internet Explorer doesn't operate by default, such as Windows Recovery discs that use the WinPE O/S.Leveraged telemetry and SQL/Reports:• Case-by-case forensic analysis of tool telemetry from support cases• Finding patterns / data mining to develop new detection heuristics and monitor other in-field problems or unexpected operational situationsWorked directly with the Awesomium (Awesomium.com) development group to debug a behavioral difference in their latest version which was preventing us from upgrading our product. Ran the debugger personally, found the API call involved, developed and successfully tested the work-around.Recent projects / research:• Advanced Adware such as Superfish and CloudScout which use man-in-the-middle attacks, fabricated root browser certificates, and digital signatures.• URL-based loadpoints such as in Trojan.Poweliks and Trojan.Bedep• Fully mapping browser loadpoints. Not all add-ons are “BHOs”. Adobe products, for example, load themselves in Internet Explorer in obscure way.• Signature/reputation analysis on non-PE / script files• Develop workflow for finding key malware sample meta-data and directing endpoints to identify and upload those samples. Especially useful for malware which tries to disable AV software and tools.

Designed and programmed in all tiers of 401K and Auto/Home sales quoting systems using Java/J2EE.Lead designer on the UI tier on a team with 10-11 developers.Had 3 employee programmers reporting to me. Mentored in Java, J2EE methodology and object-oriented design. They implemented UI web portal abstractions I designed.Isolated and diagnosed bug in threading API in IBM’s JDK1.3.1 on both Windows NT and AIX. Worked directly with IBM to demonstrate the problem in small test program and bug was added to the fix list.