Forrest Toor Email & Phone Number

Information Security professional with 11 years of experience working in a variety of IT fields giving me unique end to end systems and networks knowledge from customer service to Incident Response or Threat Hunting. I’ve operated within high pressure, time constrained environments while managing teams of up to 30 personnel.Generated training material and Splunk/ Azure Sentinel analysis environment. Developed behavioral analytics based on threat actor Tactics, Techniques, and Procedures (TTP), improving team products and offerings to clients. Trained Incident Response professionals in the procedures of Threat Hunting and threat identification through behavioral analysis. Conducted escalated incident analysis, identifying and remediating attack types such as phishingcampaigns, crypto jacking, and brute force attempts. Generated Incident Response procedures for alert handling/ escalation, incident journaling, new system integration, and insider threat detection/ mitigation. Operated and tuned alerting of Palo-Alto Cortex XDR, ProofPoint Email Security Appliance, Resecurity dark web monitoring, and Splunk Enterprise Security (ES). Performed threat hunting leveraging dark web monitoring and various threat intelligence feeds relevant to organizational attack surfaces. Created threat assessments and identified mitigations based on threat hunt outcomes. Developed briefing documentation providing leadership essential information for diagnosing enterprise security posture including data such as MTTR, MTTD. Worked with security tool vendors to integrate new systems into the Security Operations Center (SOC) by leveraging API/ Splunk data inputs, and tuning alerts. Optimized team workflow by configuring Azure Agile Kanban board for easier vertical prioritization and project – task association.Performed intelligence driven threat hunting leveraging RockNSM ELK Stack (Elasticsearch, Logstash, Kibana), Zeek, Suricata, and Wireshark. Trained 10 Cyber Protection Team (CPT) members on threat hunting best practices and methodologies. Leveraged cyber threat intelligence to identify potential Advanced Persistent Threat (APT) specific TTP’s supporting mission forward threat hunters in hypothesis development.

• 

  University Of Maryland Global Campus

  Cybersecurity & Computer Networks