Greg Gerhardt Email & Phone Number

Germany

Worldwide

Wiesbaden, Hesse, Germany

Perform malware and forensic analysis as part of the incident management process. Develop and maintain new techniques for expanding team capabilities of malware reverse engineering including setup of lab environments and creation of supporting documentation. Analyze and recommend security architecture and policy changes to improve computer network defense of U.S. Army Europe's command and control networks, both classified and unclassified. Monitor intrusion detection and security information management (SIEM) systems to detect malicious activity. Design and integrate custom rules and reports into military security tools or data collection architectures to monitor network intrusions on U.S Army military information systems and networks. Detect and resolve computer, network or system security incident problems through remote analysis, telephonic or on-site contact with users. Use an incident response management system to report and track new and ongoing security incidents. Perform threat analysis of computer vulnerability advisories, current network penetration techniques and military intelligence threat reports to determine security concerns and to design improvements to the U.S Army Europe's computer network defense posture. Oversight and training of junior analysts to ensure team cohesion and mission success.

Wiesbaden Area, Germany

Perform malware and forensic analysis as part of the incident management process. Develop and maintain new techniques for expanding team capabilities of malware reverse engineering including setup of lab environments and creation of supporting documentation. Analyze and recommend security architecture and policy changes to improve computer network defense of U.S. Army Europe's command and control networks, both classified and unclassified. Monitor intrusion detection and security information management systems to detect malicious activity. Design and integrate custom rules and reports into military security tools or data collection architectures to monitor network intrusions on U.S Army military information systems and networks. Detect and resolve computer, network or system security incident problems through remote analysis, telephonic or on-site contact with users. Use an incident response management system to report and track new and ongoing security incidents. Perform threat analysis of computer vulnerability advisories, current network penetration techniques and military intelligence threat reports to determine security concerns and to design improvements to the U.S Army Europe's computer network defense posture. Oversight and training of junior analysts to ensure team cohesion and mission success.

Wiesbaden Area, Germany

Amsterdam Area, Netherlands

Hired as first staff to gain foothold and lead the Security Operations team based in Amsterdam Netherlands with responsibility for the EMEA region. This included collaboration with Security Operations (SecOps) and Engineering teams in the West coast based offices of ServiceNow (ie. Seattle, San Diego) as well as planning for eventual SecOps growth into the Asian market and the Middle East. Day-to-day operations consisted of analysis of alerts from Palo Alto Networks (PAN) Firewalls, Sourcefire IDS, DHCP Logs and other relevant information gathering tools to perform network analytics on potential network intrusions and possibly infected endpoint hosts. Assisted in design of requirements for a malware lab environment allowing for reverse engineering and other forms of malicious code inspection. This analysis helped to supply data to intel and threat feeds allowing the organization to stay abreast of threats as they emerged. Roles also included collaboration with the facilities department to physically secure the Amsterdam and other offices, globally.

Mannheim Area, Germany

Search and response for incidents on the Army network in Europe and Africa.

Sierra Vista, Az

Leading supervisor for 45 Information Assurance experts for varying projects associated with ISEC/IASED tasks in support of the ongoing Department of Defense Information Assurance Certification and Accreditation (DIACAP) effort. Responsibilities included directing inbriefs and outbriefs, collection, analysis and auditing of documentation, interview with site personnel, management of subordinate team members, creation of DIACAP deliverables, interface with government personnel, and research of applicable tools and related information. Performed in depth analysis of United States Army infrastructure from standalone type accredited systems to installation-wide infrastructure with full system accreditation. Accountable for detailed weekly reports outlining activities performed. Spearheaded creation of documentation for various assigned projects in support of final goal of accreditation. Responsible for special requests made by government personnel in support of the overall mission. Was assigned a number of different responsibilities ranging from oversight of multiple, to very specific efforts, for both engineering and certification depending on what was required to meet customer demands. All assigned tasks were ongoing, high visibility efforts with reporting required directly to government personnel. Also accountable for quality assurance of documents and deliverables turned in by other STG employees, as well as assistance with issues that staff may be having such as equipment procurement or specific task related questions/issues.

Sierra Vista, Az

Provided security analysis and penetration testing of all CONUS Army installations, utilizing security and penetration tools including Metasploit, Core Impact, Nessus, Kismet, Retina, Harris Stat (Patchlink), ISS, and custom administration sets to assess network security and exploit weaknesses to demonstrate needed fixes and risk mitigation. Train installation information management staff in appropriate use of security tools and system administration to include patching tools and anti-virus software. Research threats against US military information infrastructure for presentation. Authored wireless survey Tactics, Techniques and Procedures (TTP) documentation for detection and penetration of secured wireless networks being used at RCERT-CONUS. Developed, scripted, and filmed remote Bluetooth exploitation demonstration used Army-wide.

Sierra Vista, Az

Responsible for detecting, responding to and neutralizing unauthorized computer intrusions of Department of the Army information systems throughout the Continental United States. Duties included recommendation of blocks on the military routers to keep problem systems contained and unwanted users out, ensuring Common Access Card (CAC) enabled authentication where applicable. Ensured users do not divulge classified information; implementation of the resulting cleanup process if this did occur. Investigated and mitigated issues arising from unauthorized systems connected to the network.

Sierra Vista, Az

Responsibilities included performing WAN management functions for over 200+ Army installations across the Continental United States. Monitor, manage, analyze, and configure Army Top Layer Architecture (TLA) consisting of CISCO routers, switches, and various firewalls. Ensure proper configuration of network routing protocols including TCP/IP, OSPF, BGP, Frame Relay, and ATM. Utilize various network management tools such as Cisco Works 2000, WS-Watch and Net Health. Provide customer support for network operations, firewall installations, and connectivity problems.

Bachelor Of Science (Bs), Computer And Information Systems Security/Information Assurance

Education record