Audit & Logging Manager - Elastic- Lead a team to successfully migrate from ArcSight to Elastic as the AFDCGS system of record. This required distributing tasks for 7 different infrastructure / enterprise services teams during the upgrade. Lead a daily hotwash for DCGS leadership to give the status of tasks completed, daily/weekly goals, and any roadblocks. During the upgrade, I developed an auditing requirement checklist with our site ISSM to ensure Elastic carried over all auditing /… Show more Audit & Logging Manager - Elastic- Lead a team to successfully migrate from ArcSight to Elastic as the AFDCGS system of record. This required distributing tasks for 7 different infrastructure / enterprise services teams during the upgrade. Lead a daily hotwash for DCGS leadership to give the status of tasks completed, daily/weekly goals, and any roadblocks. During the upgrade, I developed an auditing requirement checklist with our site ISSM to ensure Elastic carried over all auditing / retention requirements from ArcSight. After ensuring all requirements were met and the upgrade was completed before our deadline, I presented the findings to the DCGS Cyber Chief (GS-15) and the DCGS Material Lead (Lt Col) at Robins AFB. - Lead a team of engineers to conduct system administration/engineering of ArcSight, 6 ELK Custers(2x6 node, 2x10 node, 2x15 node), Windows Event Collector, and Syslog servers at 30+ sites. This included tasks such as editing Windows XML Security Subscriptions for better log management and readability for analysts. Day-to-day Windows/Linux server troubleshooting to not only maintain uptime, but also necessary security log retention periods.- This role required travel to meet with Government and Air Force leadership to discuss implementation of new tools to a classified network. Gave suggestions on Elastic architecture for VM sizing requirements, as well as a list of hardware needed for an on-prem build. Traveled to the annual DCGS Security summit at Hickam AFB as a Speaker to represent Langley AFB. Spoke about the necessity of security auditing and retention, I also gave demos as to what visibility our tools can bring to the enterprise. Trained current ArcSight SME’s on the ELK stack with written guides in addition to hands on training.- Developed dozens of TTPs for enterprise-wide updates, configuration changes, and new product deployments. TTPs included Linux system administration, Windows Event Collector updates, and Elastic installs. Show less