Rommel Lastra Email & Phone Number

New York, United States

United States

Managed Security Service Provider - SIEM Services-ArcSight SIEM platform administration/SME for the Americas business unit, architecture and deployment. Appliances include Logger, ArcManagementCenter and ESM Manager-Formulate actionable items in the form of threat based custom/complex correlation rules, views, reports, alerts and dashboards for MSSP clients-Create use cases and custom correlated content based on client’s business needs and perceived risks-Incident Response-Create regular expression, syslog, csv and file based ArcSight FlexConnectors-Integrate Open Source intelligence feeds-Security Operations Center Lead-Developed workflow process for the Security Operations Center-Trained peers on packet analysis, analysis, malware detection and basic scripting concepts-Trusted security advisor for clients (security posture review meetings and recommendations)-Designed and deployed ArcSight platform to allow for scaling up to support over 100,000 EPS for all US clients-Developed integration between ArcSight and Service now ticketing system-Help to develop the service, developed operational deliverables. Worked with product management and service management to build out the service descriptions and objectives of the service.

Jersey City, N.J.

Enterprise Information Security-ArcSight SIEM infrastructure administration-Incident Response-Monitored, detected and analyzed anomalous activity-Created regular expression based ArcSight FlexConnectors-Integrated Open Source intelligence feeds-Worked with developers and business units to assess and identify business critical application functions which require log ingestion and parsing

Greater New York City Area

-Splunk/Enterprise SIEM, McAfee/NitroSecurity SIEM administration. Duties included creating custom correlation rules to identify unauthorized access, scanning, and malicious code to strengthen the security posture of the organization. Created views, reports, alerts, dashboards and provided training to other members-Performed device image acquisitions for further forensic investigations.-Administered Syslog-ng infrastructure-Administered and analyzed network traffic utilizing NetWitness Spectrum, Investigator,Informer, and Administrator appliances. Series 4 generation appliances-Administered SourceFire NIDS appliances and created custom content toidentify possible threats-Monitored global network for intrusion/extrusion attempts. Analyzed network traffic toassess, prioritize and differentiate between potential intrusion attempts and falsepositives; launched investigations; composed and sent alert notifications, anddeveloped automated detection for profiled threats. Tools utilized include real-timeawareness capabilities of FireEye-Researched critical vulnerabilities, exploits, viruses and interacted with users onvarious security issues-Collaborated with team/organization members in the development and execution of network security posture

Greater New York City Area

National Incident Response Team – Threat Analysis Center-Obtained National Security Clearance - Secret Level in 2008-Rendered first level and second level incident response, Intrusion DetectionSystem, Intrusion Prevention System, firewall/antivirus monitoring, analysis, andsecurity event response to information security alert events for the Federal Reserve Bank and U.S. Treasury systemsCreated and modified filters, channels and reports via Arcsight SEIM Platform Performed post-mortem analysis on traffic flows and other activities to identifymalicious activity-Performed all assigned duties in compliance with ISO 9001 quality managementand ISO 27001 Information Security Management System standards-Managed complex tracking and data analysis tasks in order to identify livecomputer attacks and probes as they occur-Ensured NIRT operational continuity and maintain supporting infrastructure.-Assisted in the development, testing and implementation of security plans,products, control techniques, security policy and procedures for national networksecurity oversight and intrusion response tracking-Investigated and recommended appropriate corrective actions for data securityincidents including effective communication with supporting groups-Assisted in the definition, construction and continual enhancement of an effectiveintrusion detection architecture

Jersey City, N.J.

-Rendered support in Network Control Center environment, including first andsecond level network troubleshooting-Monitored/maintained network health status, utilizing network managementsystems; (i.e., Netcool, CiscoWorks, Netgear, InfoVista, Spectrum, PAM, Sniffers,-P-Cap, Site Manager)-Directed the resolution of network-related problems and major outages-Collaborated with and support ADP groups, vendors and clients, in order toaddress time sensitive matters-Served as an effective team player, in order to achieve optimum outcomes-Trained coworkers on Cisco platform-Mentored and instructed staff-Traveled to client sites to ascertain a resolution efficiently and effectively-Afforded quality assurance on newly installed communication configurations andequipment-Represented ADP as a provider of “World Class Service”

Greater New York City Area

Responsible for maintenance and customer satisfaction of Bloomberg’s criticalaccount, Lehman Brothers;- Support of over 700 users on site- Maintained BLN Nortel routers, maintained, deployed, troubleshot Cisco/Bayrouters, installed and troubleshot LANs, troubleshot T1, 56K, ISDN, and Analogcircuits, worked with Telco to resolve circuit issues, trained and mentoredpersonnel