James E. Email & Phone Number

Stoke-On-Trent, Gb

In my current role as a Malware Analyst and Detection Engineer at Proofpoint, I’ve developed over 20,000 Suricata/Snort rules with an emphasis on exploit detection and fine-tuned more than 50,000 additional rules. My work includes coverage for critical vulnerabilities such as PrintNightmare (CVE-2021–1675, CVE-2021–34527, and CVE-2021–34481) and Log4j (CVE-2021-44228).I’ve also conducted side research into metadata usage, leading to improvements in our ruleset by adding 'confidence' tags and MITRE ATT&CK support. Additionally, I’ve designed and developed tools that have drastically improved detection engineering workflows, streamlining processes and increasing efficiency.My contributions extend to Python development for production systems, enhancing automation and scalability. I also support incident response efforts, collaborating with customers to address complex threats and reduce false positives.Core expertise demonstrated in this role can be categorised as follows:Malware/exploit analysis & detection, Suricata rule development & advanced tuning, mentoring and training new detection engineers, detection of PrintNightmare, Log4j & other critical exploits, detection engineering workflow optimisation, confidence tagging & MITRE ATT&CK integration into the Emerging Threats IDS rulesets, python development for automation, and incident response & customer support.

Arm

Perimeter vulnerability management for the global ARM estate, risk management, liaising with multiple teams & departments to discuss patching strategies, 3rd line remote tech support, incident response & malware triage, daily threat intelligence, SIEM rule tuning, IDS monitoring, internal audits, firewall configuration management.