Eric B. Email & Phone Number

Lexington, Ky, Us

Remote

>Conducts planned and authorized real world attack scenarios against corporate assets, networks and applications utilizing common hacking methodologies and tools. >Leveraging industry standard methodologies, evaluates corporate security posture through various technical, manual and automated methods to accomplish various designated goals such as the review and evaluation of software or network architecture and design (consulting), >The coordinated validation of defensive controls (purple team), >Attempted exploit, pivot and exfiltration of data (red team) and manual review >Validation of the existence of vulnerabilities on systems (penetration testing).

>Performing installation and configuration management of security systems and applications, including policy assessment and compliance tools, network security appliances and host-based security systems >Performing threat and vulnerability assessments, in some cases followed by appropriate remedial action, to ensure that systems are protected from known and potential threats and are free from known vulnerabilities>Collating security incident and event data to produce monthly exception and management reports >Developing and maintaining documentation for security systems and procedures>Locating and repairing security problems and failures>Assisting and training junior team members in the use of security tools, the preparation of security reports and the resolution of security issues>Researching, recommending, evaluating and implementing information security solutions that identify and/or protect against potential threats, and responding to security violations>Reporting unresolved network security exposures, misuse of resources or noncompliance situations using defined escalation processes

• Perform full cycle engagements of penetration testing on business units as part of a team• Configure, run and monitor automated security testing tools• Perform manual validation of vulnerabilities• Perform manual penetration testing of client systems, web sites and networks to discover vulnerabilities• Thoroughly document exploit chain/proof of concept scenarios for client consumption• Communication skillset to influence SVPs, VPs, Directors, and Domain Managers to prioritize and execute remediation plans• Ability to develop innovative tools, solutions, processes which scale across a >100,000 resource global organization• Incorporate business considerations (e.g. loss of earnings due to downtime, cost of engagement, etc.) into security strategies• Research, document and discuss security findings with management and IT teams• Review and define requirements for information security solutions• Work on improvements for security services, including the continuous enhancement of existing methodology material and supporting assets• Provide feedback and verification as an organization fixes security issues• Responsible for developing and executing formal web application security test plans to ensure the delivery of quality software applications.• Involved in test planning, preparation and communication with client prior to security test execution.• Performs web application attack & penetration testing to find security issues such as risks, defects and logical errors.• Collects and analyzes security data from manual, automatic and static source review, and integrates them to find best way to address security issue to meet the needs of the business.• Documents all issues and assists in their resolution.• Delivers security training and education t technical staff within findings and acts as an internal security consultant to advise or influence business or technical partners.

Lexington, Kentucky Area

·Working understanding of HIPAA Privacy and Security regulations and state/local privacy laws.·Review Policy Compliance Management reports generated by HPSA with the Security Administrator. ·Review reports generated by NESSUS vulnerability scanning. Work with the leverage groups to remediate findings or create a Business Case Justification·Review user inactivity reports for single sign on application (MEUPS), database, UNIX, and Windows environments·Conduct monthly reviews of privileged access·Coordinate full risk assessment of the QEX baseline audit and HIPAA audit modules every three years.·Coordinate annual SSAE16 audit·Maintain and review Acceptable Use policy·Maintain all documentation supporting HIPAA compliance·Work with KY MMIS ADM during the annual disaster and recovery drill.·Attend monthly meetings with ITO Security Administrator to assess health of the account and develop plans to further tighten privacy and security of the KY MMIS.·As needed, draft incident reports and review with both KY MMIS account management and privacy and security staff at Office Administrative Technology Services. As part of the incident response plan, evaluate the root cause of the incident and implement any remediation steps necessary to preclude any future incidents.·Conduct quarterly reviews of badge access for the KY MMIS facility·Work with HP General Procurement to maintain current Business Associate Agreement and Agent Subcontractor agreements with the covered entity and vendors of the KY MMIS.·24/7 availability to address any privacy and security events reported by the SIEM SOC. ·Review weekly and monthly log monitoring reports from ArcSight.·24 availability to address privacy and security incidents.·Maintain KY MMIS account compliance with core ESIS controls. ·Evaluate day to day operations of the KY MMIS to evaluate compliance with all HCI Directives and implement corrective action as needed.

•Identify and mitigate security vulnerabilities on networks ensuring compliance•Setup and was responsible for SCCM 2012 backend and daily use for patching and compliance•Compiled and presented weekly compliance metrics for senior management and colleagues •Performs analysis of potential vulnerabilities and provides remediation recommendations•Rotating on-call weekend or evening support for maintenance and troubleshooting.•Perform secondary administration duties (e.g., Non-windows systems, Data Center, hardware management, metrics management and reporting, etc.)

Coordinate with FBI/CIA Intelligence Analyst on digital interrogation video archival systemSupport of Command Staff and Theater Intelligence Group

Assign, modify, and delete passwords and user privileges according to AFMAN 33-223Operate and maintain Department of Defense LAN/WAN networks in accordance with security and technical specifications with heavy emphasis on TCP/IPActive Directory administration of coalition and US military personnel on classified networks such as NIPR/SIPR/.Troubleshoot CISCO switches to include configuring port security, etc.Perform network support functions; network operations center (NOC) functionsMaintain and Troubleshoot telephone systems.System performance tuning and disaster recovery planning.Modify and configure share permissions for deliberate access to resources.Installation, configuration, upgrade, administration, monitoring and maintenance of network infrastructure.

Afghanistan Combined Security Transition Command CSTC-A CJ3 Kabul, AfghanistanSetup and facilitate classified Video Teleconferences with Command Staff, VIPs and NATO Coalition forces in theater and internationally to include TANDERG and PolyComm Systems.Operate and maintain Department of Defense LAN/WAN networks in accordance with security and technical specifications with heavy emphasis on TCP/IPImplemented strict security measures in order to maintain integrity of operations in Operation Enduring FreedomActive Directory administration of coalition and US military personnel on classified networks such as NIPR/SIPR/ISAF/CENTRIXS/CPOF.Troubleshoot and maintain CISCO switches.Maintain and Troubleshooting for telephone systems.

Project Management for Intellectual Property database acquisition and integration Member of the Desktop Technical Services team by providing direct support to the president's office, University Hospital and other executive-level users.Remote access of user machines to troubleshoot and catalog in database until resolved. Deployed software/images to users through the use of System Management Service 2003/2007Purchasing and deploying enterprise systems/servers.Support of Oracle and SQL systems Administered several thousand computers in an Active Directory environmentCoordinated efforts between private vendors and campus network as projects required.

Deployed in support of Operation Iraqi Freedom, rotation IIIInterrogation/Intelligence gathering/security escorts/emergency response teamServed in junior leadership roles in highly stressful environments

Maintained seven microcomputing labs by preparing and deploying images for engineering faculty.Supervised five student workers and coordinated their efforts with others in the department.Support faculty, staff and students in primarily a Microsoft Windows environment.Troubleshoot and install Novell Clients, Lotus Notes and other server/client dependant software packages.Administered user accounts/resources in Windows/Unix environment. Aided in developing disaster recovery policy and procedureAssist in evaluating network related difficulties and prescribing solutions.

Assisted in accessing information through use and maintenance of relational databases and operation of paging systems for medical personnel. Aided medical Center staff in using lab materials and preparing digital teaching aids to be incorporated into lectures and seminars.Helped to refine media prior to incorporating it into presentations for teaching seminars. Refined projects.

Masters, Cybersecurity And Information Assurance

Bachelors Degree, Telecommunications

Graduate Certificate Programs: Penetration Testing & Ethical Hacking