Kurt Wolfe Email & Phone Number

Mountain View, California, Us

Cleveland, Oh, Us

• Demonstrated expertise in leading and executing sophisticated threat hunting initiatives as a key member of the Cyber Threat Intelligence (CTI) and Security Operations Center (SOC) team. Leveraged (EDR) data and extensive Splunk environments to proactively identify, mitigate, and respond to advanced cyber threats, ensuring the security and integrity of our organization's digital assets.• Regularly utilize an extensive suite of solutions to safeguard our infrastructure. These include, but are not limited to, CrowdStrike Falcon, Proofpoint, Abnormal Security, Zscaler, Qualys, Dragos, and Wazuh. By implementing these advanced technologies, I effectively enhance our security posture, streamline incident response processes, and craft custom detections to ensure the highest level of protection for our organization.• Conduct global-scale incident response forensic investigations, encompassing user systems and Industrial Control Systems (ICS) on multiple operating platforms including Windows, Linux, and OSX.• Proficient in implementing and executing security solutions on major cloud platforms (GCP, Azure, AWS)• Demonstrated expertise in crafting clear, concise reports for technical audiences and executive management. Proficient in translating complex cybersecurity concepts into accessible language for various stakeholders.• Knowledgeable on utilizing open-source toolkits from GitHub for OSINT, red team, blue team, DFIR, and artificial intelligence purposes. For example I implemented Capev2 (fork of cuckoo) in a private azure tenant to allow for private malware analysis.• Automation development and implement Python scripts as well as advanced playbooks within SOAR platforms for streamlining daily SOC and CTI tasks, enhancing operational efficiency.• Experience in creating, managing, and utilizing QEMU/KVM/Proxmox virtual machines for establishing secure laboratory environments both inside and outside of corporate environment.

Beachwood, Ohio, Us

• Administer Security Information and Event Management (SIEM) functionalities in Splunk Enterprise Security, ensuring efficient event collection, correlation, and analysis as a security contractor.• Collaborate with internal and external teams on designing, developing, testing, and maintaining security use cases in Splunk Enterprise Security across various clients and environments to enhance threat detection and mitigation. • Conduct thorough testing of security use cases to ensure accuracy and effectiveness. • Ensured high-fidelity delivery of content through meticulous tuning and testing processes.• Provide ongoing support for use case maintenance, updates, and optimization.• Contribute to data normalization efforts within Splunk Enterprise Security to improve data consistency and accuracy. Leveraging CIM compliance and Splunk best practices. • Implement advanced threat detection methods by emulating attacks in a controlled testing environment and generating corresponding use cases based on log analysis leveraging purple team techniques. • Developed and implemented advanced Security Orchestration, Automation, and Response (SOAR) workflows to streamline SOC team operations for both internal and external clients• Demonstrated proficiency in utilizing GitHub for version control and implementing DevOps best practices to ensure secure SPL development, as well as documentation for clients.

Beachwood, Ohio, Us

• Supervised and managed the day-to-day operations of the Security Operations Center (SOC)• Organized frequent educational workshops and mentoring programs to encourage continuous learning and skill development among team members.• Strategically expanded the team through the recruitment of new hires or engagement of external experts to enhance the organization's capabilities.• Developed and implemented Security Operations Center (SOC) performance goals aligned with organizational objectives• Established key performance indicators (KPIs) to measure SOC effectiveness and efficiency as well as configured regular reporting and analysis of SOC metrics to identify trends and areas for improvement• Implemented automation and orchestration tools to streamline SOC processes and improve incident response times• Utilized and regularly assess open source tools to enhance the Security Operations Center (SOC) capabilities, enabling more effective investigation and delivering superior client information through advanced alerting.• Communicated potential risks and required actions to senior management in a prompt manner, including relevant details such as impact assessment and root cause identification.• Oversaw the management of SOC Analysts in a round-the-clock (24/7), shift-based environment• Wrote clear and concise summaries of complex events or incidents for various stakeholders including legal counsel, executive management, and technical teams, both verbally and in writing.

Beachwood, Ohio, Us

• Prioritized and addressed security incidents in multiple client Splunk environments by performing triage, investigation, and escalation as necessary.• Performed comprehensive investigations and proactively searched for potential threats on behalf of clients utilizing Splunk and extremely large datasets. • Regularly analyzed complex data sets to identify patterns, anomalies, and trends using statistical analysis, machine learning algorithms, and other data analysis techniques.• Performed a comprehensive audit and risk assessment utilizing Splunk and security appliance data for clients. • Contributed to enhancing security alert effectiveness by distinguishing and suppressing false positives• Helped the management of our Intrusion Detection System (IDS) sensors, including updates and fine-tuning of rule sets for optimal performance.