Kellie Logan Email & Phone Number

Remote

• Lead a team of incident responders (IR Team) and vulnerability analysts (VM Team), providing guidance as needed for proper handling of security incidents and vulnerabilities across the enterprise• Define, implement, and grow the strategic vision for the Incident Response and Vulnerability Management programs• Actively train, coach, mentor, and develop the team by providing open and transparent communication• Assess team performance by identifying trends, validating appropriateness of recommended corrective actions, and directing remediation activities to ensure accountability, reduce organizational risk, and demonstrate compliance• Develop and maintain the Incident Response Program Guide to provide a framework for incident handling activities• Develop and maintain the Vulnerability Management Program Guide to assist enterprise product owners in vulnerability identification, severity classification, remediation timelines and expectations of systems they’re accountable for• Evaluate vulnerability scan dashboards to analyze results, identify areas of risk, and make recommendations• Identify processes where automation can potentially be leveraged to improve team or process efficiency• Manage partnerships with multiple security vendors to ensure these services continue to align with the strategic direction• Engage with all levels of leadership across the enterprise to provide updates, recommendations, and subject matter expertise

Beloit, Wi

• Worked with clients to implement security measures, including the development of information security policies, procedures, and standards in alignment with business plans, goals, and objectives• Completed vulnerability assessments, drafted detailed resulting output, and met with customers to review results, including estimated costs associated with mitigating or accepting the potential risks• Developed detailed project plans and scope with estimated hours for completion for all new server project RFPs• Reviewed Group Policy configuration and other system hardening settings as well as network configurations to ensure that they conform to vendor and industry best practices• Audited server event logs and correlated with other events/traffic for signs of anomalous and malicious activity• Performed all work to complete server infrastructure projects, including ESXi setup and configuration, in-place server upgrades, migrations to newer OS and/or application version, new Active Directory domains, etc. while providing transparent and timely communication to minimize any negative customer impact and ensure the most positive customer experience possible• After any report or discovery of a cyber security incident, took on the role of cyber incident manager to ensure proper handling, including facilitating all communication with a customer’s cyber security insurance provider and/or law enforcement • Successfully recovered 7 separate Active Directory environments without functional backups following ransomware incidents• Managed the day-to-day activities and time-to-resolution for tier-1 and tier-2 service technicians, assisting them with any gaps in their knowledge while triaging escalation requests for any hardware or software issue on Windows 7, 8, 10 workstations• Troubleshot and resolved hardware and tier-3 software issues related to servers: Windows Server 2008 R2, 2012, 2012 R2, 2016, 2019; ESXi and vCenter 6.0, 6.5, and 6.7; and Veeam Backup and Replication

Annapolis Junction, Md

• Conducted vulnerability assessments/penetration tests of information systems• Conducted forensic examination processes on media including hard drives, memory cards, and thumb drives• Conducted imaging and data extraction on a variety of devices• Developed forensic reports supporting criminal investigations and prosecutions• Tracked threat actors and associated tactics, techniques, and procedures (TTPs) by capturing intelligence on threat actor TTPs and developing countermeasures in response to those threats• Performed network traffic analysis using firewall logs, IDS/IPS/DLP logs, raw packet captures, network flow, and custom sensor output from communication networks

Fort Meade, Md

• Conducted CNE operations to fulfill critical national level requirements in support of foreign intelligence collection efforts• Analyzed networks to identify and assess vulnerabilities and weaknesses to enable and conduct CNE operations• Provided post-mission written analysis and oral briefs to both peers and management• Deployed numerous virtual training and testing environments using diverse VMWare infrastructure• Triaged malware or unknown binaries by analyzing strings, handles, loaded modules, BaseNamedObjects, and network connections to determine purpose, persistence mechanism, propagation method, perceived level of risk, and capabilities• Conducted tool testing against various versions of security products and operating systems to ensure expected functionality• Mentored CNE operators and recommend training to maintain current performance and ensure success in future operations

Beloit, Wi

• Troubleshot and resolved hardware and software issues related to workstations: Windows XP, Vista, 7, 8 as well as servers: Windows Server 2003, 2008, 2008 R2, 2012, 2012 R2, and Small Business Server 2003, 2008, 2011• Audited server event logs for signs of anomalous and malicious activity• Remotely performed new software installations, maintenance, and upgrades on customer systems including Exchange• Completed 21 large-scale virtual server project builds and implementations including areas such as: Active Directory, DNS, DHCP, AD CS, AD FS, RADIUS, Exchange 2010 and 2013, Exchange Online, and customer-specific system integrations/upgrades• Proactively monitored and administered physical and virtual servers upon identification of errors, failures, or misconfigurations• Responded to level 2 and level 3 support requests from customers regarding hardware and software failures, malware, email transmission issues, network slowness, share permissions, NTFS permissions, and terminal services application problems• Conducted data restoration from backup and resolved issues with numerous backup software products and jobs that were either not backing up, collapsing, or syncing properly• Designed and implemented changes and scripts within Connectwise Automate to monitor unique customer needs, specific event log entries, as well as resolved issues that appeared on multiple workstations to minimize the need to 'touch' each one

Madison, Wisconsin Area

* Monitored and administered Hyper-V servers through Microsoft System Center Virtual Machine Manager* Diagnosed server, desktop, laptop, and iPhone problems relating to hardware, software and/or user error* Created and managed users, groups, and computers inside Active Directory as well as group policy objects in Group Policy* Ensured all daily, weekly, monthly and duplicate backups are successful and update rules/policies within BackupExec* Responded in person to user and management support requests, with a focus on efficient customer service regardless of the true nature of the initial request (technical, training, user error, etc.)* Prioritized support requests to resolve the most critical elements first to minimize customer impact* Audited Microsoft licensing compliance for all Microsoft desktop and server operating systems, Office Professional Plus, Project, and Visio; as well as Adobe Acrobat and Creative Suite

7300 N. Melvina Ave., Niles, Il 60714

101 E. Wilson St., Madison, Wi 53703

Bachelor Of Applied Science - Basc, Computer Networks And Security, 3.9

Master'S Degree, Information Security And Forensics