- Execute post-intrusion analysis of digital/electronic media to identify who, what, when, where and how the intrusion transpired- Provide technical reports following post-intrusion analysis - Perform analytical analysis, focused on datasets such as computer operating system logs, pen trap and trace data, firewall logs and server logs using network theory and data mining concepts to reveal relationships, patterns, trends and statistics, link analysis, timeline analysis, and data visualization techniques- Execute technical profiling to analyze user accounts, network data, and computer systems to provide operational assessments such as technical capability, signature attribution, network surveys, system change detection and anti-forensic methods detection.

Focused Operations Analyst - Transportation Security Administration• Perform eDiscovery and forensic analysis on workstations/servers/mobile devices within an enterprise environment.• Provide support to legal council as well as special investigators and LEOs (Law Enforcement Officials).• Provide data recovery services to enterprise clients.• Evaluate and make recommendations for the purchase of tools/technology in support of the Focused Operations mission.• Design and develop custom tools to fill gaps in situational awareness and reduce client technology costs.Cybersecurity Analyst / Incident Responder – U.S. Mint• Analyze alerts and events coming from multiple sensors/tools (i.e. SIEMs, Firewalls, etc.) and mitigate events in a quick, accurate manner.• Knowledge and use of various cybersecurity tools/software (i.e. Wireshark, FireEye, Splunk, EnCase, etc.)• Triage events according to client directives• Perform forensic acquisitions/analysis as dictated by events.• Perform behavioral (dynamic) malware analysis as necessary• Recommend mitigation strategies, and present solutions to maintain and upgrade cybersecurity solutions and meet new challenges in a constantly evolving enterprise environment.

• Establish, document and coordinate the implementation of the Forensic Lab requirements.• Establish and maintain a Digital Forensic SOP documenting the procedures employed when completing a digital forensic analysis.• Engage incident handling and forensic expertise to identify, capture evidence of, document and mitigate cyber threats.• Conduct in-depth analysis of identified/suspected cybersecurity abnormal events and produce formal reports of the analysis.

Civil GroupNSOC Computer Forensic Services, Department of Veterans Affairs• Remote forensic collection of electronic data from computer systems, including hard drives, servers and back-up media.• Examination of collected data (i.e forensic images, logs, etc.) for detection/determination of cyber intrusions, breach of policy investigations, and malware analysis.• Provide support to forensic processes and procedure improvement, as well as integration of new tools into existing processes and procedures.• Basic case administration in support of eDiscovery investigations via the Clearwell eDiscovery Platform.Technology Capability and Cyber Technologies Center of ExpertiseProactive Threat Identification (PTI) Cell• Responsible for collecting and analyzing data gathered from proprietary AFR tool with the goal of identifying Advanced Persistent Threats (APTs) targeted at Booz Allen Hamilton and its’ employees.• Provide computer forensic and intrusion support to high technology investigations and cyber-security inquiries in the form of computer forensic analysis, data recovery, and network assessments.• Research and maintain proficiency in tools, techniques, countermeasures, and trends in computer network vulnerabilities, data hiding, and network security and encryption.

• Collect, preserve, harvest and recover electronic data from computer systems, including hard drives, servers and back-up media, while maintaining/preserving authenticity and chain of custody.• Convert and organize large amounts of electronic data into a user friendly format that can be accessed and shared by end-users in a collaborative electronic environment.• Perform investigative analysis of electronic evidence using various tools such as EnCase, FTK, etc.

 Provide technical support for computers and associated networks at the Department of Justice.

 Provide on-site technical support to internal clients.  Troubleshoot hardware and software issues and provide solutions to hardware and software problems (repair/replace/reinstall). Troubleshoot TCP/IP and networking issues (Authentication, connectivity, etc.) Educate users on software tips and tricks. Setup/Troubleshoot/Educate Audio/Visual equipment (Projectors, microphones, VTC equipment and connections, etc). Provide technical expertise to on-site office manager in areas of technology required for the day-to-day operation of conference facility.