Nicholas S. Email & Phone Number

Mountain View, California, Us

New York, Ny, Us

- Technical lead of security team: - Guided technical decisions related to cyber security - Planned, designed, and implemented a practical (hands-on) interview process to screen applicants - Held weekly "capture the flag" sessions with security team to enhance offensive/defensive capabilities - Trained 200+ members of IT department on various cyber security topics such as ransomware and phishing - Developed and conducted phishing exercises to thousands of employees around the world- Led the Incident Response process: - Acted as Incident Coordinator throughout the organization for all major incidents - Developed Incident Response Plan and Playbooks - Engaged with and trained all incident response stakeholders via table-top exercises - Liaised with international law enforcement and third-party investigators for civil cases - Gathered and maintained forensic evidence in accordance with international best practices- Managed budget (> $1 mil) for threat intelligence, endpoint defense, malware analysis, and other projects: - Screened and selected vendors for many major projects, negotiated pricing, and purchased hardware and software to accomplish goals - Ability to negotiate at a technical level helped cut pricing in some existing tools by 30% - Analyzed and cut vendors not providing value to the company, in some cases saving the company hundreds of thousands per year.- Admin of Splunk Enterprise / Enterprise Security - Maintain 15+ Red Hat servers related to Splunk infrastructure - Wrote dozens of dockerized Python scripts to gather, parse, and store data from various APIs into Splunk- Established asset management system: - Consolidated data from Active Directory, DHCP, network scanners, and multiple other sources to provide a holistic vision of the Fragomen IT environment - Ensured tool coverage on endpoints was up-to-date and complete - Found rogue and unmanaged devices connecting to the network

New York, Ny, Us

- End of the line for cyber incidents. Was hands-on and a main point of contact for every major cyber incident at Bloomberg in the past 2 years.- Designed, developed and implemented multiple enhancements to the Cyber Security Operations Center (CSOC): - Mass hash scanning system - sends the hash of every unique file run on the corporate network to a cloud-based AV solution. - Endpoint evidence gathering suite - used by analysts to obtain ephemeral information from suspicious hosts for deeper analysis with a single click. - Anti-worm defensive solution – after obtaining indicators from a network worm, provided code to be run enterprise-wide that eliminates the threat. - Alert inventory – created a database of every possible alert active in our CSOC with the type of threat and zone it protected.- Re-worked an Intrusion Detection System from the ground up to provide actionable, accurate and timely alerts for all network traffic leaving the enterprise.- Created and taught a training system used to get all analysts to a baseline level of knowledge regarding cyber security.- Presented multiple advanced cyber security lectures regarding incident response and malware analysis.

Reston, Virginia, Us

- Led a malware analysis team in the research and documentation of professionally-developed malware, providing ready-to-deploy defensive signatures to network defenders and the intelligence community. - Researched and implemented 64-bit and mobile malware analysis platforms and tools, modernizing and increasing the usefulness of the malware lab to the extended enterprise.- Presented training to groups and individuals on malware reverse-engineering techniques, such as defeating hardened malware and breaking custom encryption routines.

Reston, Virginia, Us

- Researched, analyzed, and documented foreign computer network operations, cyber threats, and malware to support Army and Intelligence Community customers.- Used information from multiple sources to provide a complete picture of advanced persistent threats, including intrusion detection systems, open-source research, and malware analysis.

Washington, Dc, Us

Washington, Dc, Us

- Analyzed large volumes of network traffic for malicious activity, creating and implementing a myriad of signatures in order to defend against detected threats.- Conducted static and dynamic analysis of countless pieces of cutting-edge and sophisticated malware, enabling the rapid and effective deployment of comprehensive security solutions.- Worked side-by-side with Joint Service linguists, analysts, and operators to garner a full picture of threats to national security and implement preventative security measures.- Researched and implemented new technologies and techniques to better provide comprehensive analysis to customers on a global scale.

Washington, Dc, Us

- Significantly contributed to improving the Global Information Grid’s security posture through Red Team assessments.- Conducted Computer Network Operations during three long-term network exploitation operations and four short-term exercises in support of five Combatant Commands and one Federal Agency.- Invested 1500 hours to training Joint Service and civilian personnel in proper usage of Red Team tools and techniques, contributing to a highly skilled and knowledgeable team.- Supervised and directed a team of analysts and operators during multiple short-term missions, leading to a 100% success rate and further improving the perception and prestige of the team.