Erik Graham Email & Phone Number

New York, Ny, Us

Member of the Global Information Security Assessment and Incident Response team, responsible for ensuring the organization consistently adheres to its technology security policies and best practices through the implementation and use of various technical security risk assessment tools and methods.• Identify, Document, and communicate technical Information Security Risks in the organization’s data, networks, systems, and applications using standard company toolsets and assessment processes. Assist the development and refinement of global processes as required to ensure continued effectiveness;• Conduct Technical Risk and Change Reviews, enforcing Security Policies and ‘Smart’ best practices as required, ensuring information is appropriately secured. Engage business and project teams to clearly explain policies, decisions, and appropriate next steps to maximize efficiency and productivity of the Security Assessment process;• Review, contain and resolve information security incidents and conduct forensic investigations. Lead incident response calls and meetings with IT, legal/hr/compliance and other business staff in support of investigative activities;• Monitor and research information sources for 0-day and emerging Information Security threats and vulnerabilities impacting the organization and recommend, direct, and/or implement appropriate solutions to mitigate;• Influence technical and strategic direction of the Information Security function as it relates to keeping information secure and available for all MMC clients and staff.

Reston, Virginia, Us

• Member of the Enterprise Architecture Council responsible to define Principles, Target Architectures, Policies, Standards and Frameworks;• Determine security requirements by evaluating business strategies and requirements and comparing them to existing security standards;• Conduct system security and vulnerability analyses and risk assessments; • Study both deployed and proposed architecture and platforms; identify integration issues and prepare cost estimates;• Develop and maintain roadmaps for various security products and technologies;• Plan security systems by evaluating network and security technologies; • Develop requirements for local area networks (LANs), wide area networks (WANs), virtual private networks (VPNs), routers, firewalls, and related security and network devices; • Promote the concepts of information life cycle management including proper information management techniques, minimizing redundancy, improving data and information quality, and fostering data and information stewardship;• Maintain a threat intelligence process to assess threats to the business so limited security resources can be focused on immediate threats to the business in a cost effective manner;• Have spoken numerous times at both local and national conferences on a variety of information security topics including classified and unclassified audiences;• Cleared for for Top Secret (TS) w/polygraph.

Fairfax, Va, Us

• Planned security systems by evaluating network and security technologies; developing requirements for local area networks (LANs), wide area networks (WANs), virtual private networks (VPNs), routers, firewalls, and related security and network devices; designs public key infrastructures (PKIs), including use of certification authorities (CAs) and digital signatures as well as hardware and software; adhering to industry standards;• Designed and evaluated the security elements of a large private cloud environment;• Maintained a threat intelligence process to assess threats to the business so limited security resources can be focused on immediate threats to the business in a cost effective manner;• Developed and maintained roadmaps for various security products and technologies (HIPS, NIPS, encryption, anti-malware);• Converted legacy security policy and standards to meet NIST 800-53 Rev 3 (FISMA) moderate controls;• Certified and accredited several projects / applications with federal customer;• Spoke at both local and national conferences on a variety of information security topics;• Enhanced security team accomplishments and competence by planning delivery of solutions; answering technical and procedural questions for less experienced team members; teaching improved processes; mentoring team members;• Updated job knowledge by tracking and understanding emerging security practices and standards; participating in educational opportunities; reading professional publications; maintaining personal networks; participating in professional organizations;• Cleared for Top Secret (TS) w/polygraph.

Fairfax, Va, Us

• Responsible for all aspects of information security within the General Dynamics business unit, C4 Systems; • Led a 6 person team whose responsibility was to protect the confidentiality, integrity and availability of C4 Systems informational assets of over 13,000 devices used by approximately 8,000 individuals; • Developed, documented and deployed a NIST based information risk assessment methodology; • Extended the risk assessment methodology to cover the evaluation and assessment of network protocols to determine the security risks posed by the protocol and methods to mitigate those risks where possible; • Extended the risk assessment methodology to cover the evaluation and assessment of both commercial as well as open source software packages to determine the security risks posed by the software and methods to mitigate those risks where possible;• Developed a threat intelligence process to assess threats to the business so limited security resources can be focused on immediate threats to the business in a cost effective manner;• Analyzed and evaluated the security of the enterprise Voice Over IP (VOIP) deployment to identify the risks posed by the design/deployment and recommended appropriate changes to ensure the security policy and standards of C4 Systems were met; • Analyzed and evaluated the security of VLANs, 802.11 and other technologies and protocols to identify the risks posed by the technology/protocol and provide guidance as to how to secure the technology/protocol;• Analyzed the business requirements for both email and file/folder encryption and then developed and deployed a standard file, folder encryption tool across the business unit; • Ensured informational assets met FISMA, SOX, HIPAA, California SB 1386, and other state, federal and international laws and regulations as required;• Spoke at both local and national conferences on a variety of information security topics;• Cleared for Top Secret (TS) w/polygraph.

Chicago, Illinois, Us

• Responsible for all aspects of workstation (Win 9x, WinNT, Win2000, Unix) and server (WinNT, Win2000, Unix) security to include vulnerability testing, and designing/implementing security policies and procedures; • Led the project to design, develop and deploy an enterprise wide public key infrastructure project (PKI). Responsibilities on the PKI project included analyzing business needs, analyzing possible solutions and designing, testing and deploying the final solution; • Led the team responsible to develop and document the security standards for Windows 2000 Active Directory, Server and Workstation; • Led the penetration testing team responsible for performing both internal and external penetration test across the enterprise; • Worked as part of a team to design and implement a network and host based intrusion detection system; • Developed and implemented an incident response policy for computer security incidents; • Worked as an investigator, providing computer forensics for security incidents; • Provided support to HR, Legal and physical security on computer related incidents; • Tested and deployed encryption packages for use on multiple email and file systems; • Provided support for anti-virus applications across multiple platforms; • Responsible for vulnerability testing on Novell NetWare servers, Microsoft Windows NT workstations/servers, Windows 2000 workstations/servers and provided additional consultation to resolve those issues discovered;• Cleared for secret (S).

Chicago, Illinois, Us

Chicago, Illinois, Us

Us

Arlington, Virginia, Us

Masters Of Science (Ms), Information Assurance (Ia)

Bachelor Of Science (Bs), Information Technology (It)