Kevin Dolphin Email & Phone Number

Englewood, Colorado, Us

Architect, process engineer, and manage on-boarding of container security practices, “shifting left”into the Development Operations (“DevOps”) space. Partnering with over 30 DevOps Architects,and engineers to identify scale, process engineering, and vulnerability management considerationsprior to onboarding of the remainder of the enterprise.Define key performance indicators for ad hoc projects involving multiple third-party vendors todrive mutually agreed upon objectives during proof-of-concept/proof-of-value strategic tooling;including but not limited to Cloud Security Posture Management, Darkweb Monitoring, andimplementation of large scale remediation strategies.Contribute to enterprise definition(s) of “As-Is Architecture”, establishing a baseline of securityobjectives, agnostic of tool vendors, to better identify assumed capabilities over implementedcapabilities; furthering CSG’s Zero Trust Architecture cyber security objectives.Manage, define, and process engineer supporting facilities for Cyber Threat Hunting within theCSG Security organization.Lend cyber-defensive and cyber-offensive expertise to CSG’s Zero Trust Architecture definitionsand processes.Successfully transition subject matter expertise within CSG’s Penetration Testing and Public CloudSecurity program to recently established, fully fledged, engineering teams.Assist in defining security architecture and engineering vision for the coming years to driveenterprise security posture and projects.Assist in defining “micro” goals within Security Operations to establish short term objectives inincidents, projects, and ad hoc requests.Mentor analysts and engineers to accelerate career, and technical acumen, growth.

Englewood, Colorado, Us

Manage Security Operations public cloud practice, enrolling a sister organization outside of the Enterprise and guide the Cloud Security Posture Management (“CSPM”) strategy ensuring security objectives are met in a timely fashion.Manage Security Operations Penetration Testing practice, focusing on PCI penetration testing for 12 penetration tests per year and one annual test for non-PCI related environments. Tests included but were not limited to Amazon Web Services (“AWS”), on-premises data centers hosting PCI Card Holder Data Environments (PCI CDE) and the resolution of findings provided in the posttest report.Conduct multiple proof-of-concepts to identify best-in-breed tooling in Public Cloud security and container and orchestration security (e.g., Kubernetes, Docker, VMWare Tanzu).Mentor Public Cloud Security Engineering engineers as an impromptu Public Cloud Engineering lead engineer; expanding the public cloud security practice to additional cloud providers.Respond to potential real-world or simulated intrusions as a technical asset to identify, remediate, and communicate technical issues as part of a larger partnered effort with product owners and senior security management (to include communications with executive officers).Assist in defining security architecture and engineering vision for the coming years to drive enterprise security posture and projects.Manage vendor relationships for CSPM and Container Security.Manage real-time “live fire” exercises, partnering with the enterprise EDR vendor to facilitate and simulate active attacking mechanisms in AWS.

Englewood, Colorado, Us

Essential in defining and engineering public cloud critical controls governing over 200 individual AWS accounts, over 1500 Virtual Private Clouds (VPCs), and thousands of Elastic Compute Cloud (EC2).Process engineering integrations of CSPM tooling, including custom programming to deliver cloud security violations to unique teams reducing initial violation findings from over 3,000 to just under 150 unique findings over the course of 18 months.Create custom automation(s), and develop a “backbone” automation system with peers, to correlate real time findings in multiple EDR and anti-virus solutions allowing for correlation between systems automatically; reducing analyst response and dwell time.Create custom phishing automation, reducing analyst response times using Outlook email labeling and templatized responses.Operationalize EDR real-time-response mechanism(s) for remote interaction with potentially compromised hosts, immediate termination of employees, and automated deployment of response tools where other mechanisms (e.g., SCCM) failed.Create Mergers & Acquisitions playbook specific to AWS to guide pre- and post-acquisition tasks including pre-tasks for due diligence investigations using free and open-source software specific to AWS.Respond to potential real-world or simulated intrusions as a technical asset to identify, remediate, and communicate technical issues as part of a larger partnered effort with product owners and senior security management (to include communications with executive officers).

Randolph Afb, Tx, Us

As part of the Tier-2 Cyber Security Service Provider at United States Strategic Command (USSTRATCOM) conduct full-scope forensics investigations to determine root cause of incidents involving network, host, and memory forensics along with log analysis and correlation.Organize and lead activities of teams/shifts in responding to real-world and exercise/simulated cyber intrusions while developing containment and remediation strategies in the face of time-sensitive adversary aggression.Advise and inform senior leadership on real-time emerging threats.Serve as the internal escalation and conflict resolution point for ongoing investigations.Recognized as J6 Civilian of the Quarter (Mid-Tier) for 2017 1st quarter for effectively identifyingreal world and simulated cyber intrusions utilizing customized tooling, user activity monitoring,network forensics, host forensics, and reverse engineering in a time sensitive manner.

Research techniques and methodologies for the creation and deployment of "Poisoned PDFs" for the International Cyber Defense Workshop (ICDW). ICDW was a remotely hosted conference for United States Department of Defense personnel in which complex topics such as spear-phishing with malicious documents could be presented in a manner which addressed both the concerns from a defensive posture and the methods which malicious actors were currently utilizing to obtain private data on government and business networks.

Master’S Degree, Computer And Information Systems Security/Information Assurance

Graduate Certificate, Network Communications

Bachelor’S Degree, Management Information Systems, General