Ryan Crabb Email & Phone Number

Washington, Dc, Us

Boca Raton, Florida, Us

Boca Raton, Florida, Us

Boca Raton, Florida, Us

As Manager of Digital Forensics, I work with the Senior Director of Forensics to help manage and lead engagements for multiple DFIR teams. Oversee client engagements across the squads including management, client deliverable review, and promoting consistency across the squads. Develop client relationships through projects and work to cultivate and build the relationship.• Overlooking the forensics process and quality across multiple squads/teams. This includes but not limited to the forensic data and artifact collection process, quality of the forensic analysis, and the satisfaction of the client, counsel, and carrier.• Ability to investigate sophisticated breaches leveraging unique tactics, techniques, and procedures (TTPs).• Ability to provide forensic expertise and provide support on Scoping Calls and one-on-one calls with client, counsel, and carrier.• Act as a mentor, assisting staff, provide review of all forensic work product to ensure consistency and accuracy, and support based on workload or complexity of matters.• Develop client relationships through the execution of projects across the assigned squads.• Responsible for maintaining target utilization that comes from client billable work including forensicanalysis, participating in client update or forensic scoping and update findings calls, client correspondence related to forensic analysis, data collection, or investigative questions verbally or in writing.• Support Director of Forensics with identifying process and technical improvements, training opportunities, assessing, and onboarding new technologies.• Support Director of Forensics with delegating and managing the squads.• Work with team members to advise various counsel and/or carriers on Arete’s businessmethodology, post-breach and post-IR process, and overall support that Arete can provide.• Contribute to the curation of threat intelligence related to breach investigations.

Boca Raton, Florida, Us

The Forensic Lead manages all aspects of the Incident Response engagement, including team’s performance, delivery and client development. Operating as industry leader in Incident Response, and trusted advisor, to the client and breach coach ensuring 100% client success! Forensics Leads provide breach coaches and Insurance Carriers tailored detailed analysis and reports on how unauthorized access and cyber intrusion occurred* The Forensic Lead is responsible for providing their forensic data and artifact collection requests needed for the forensic analysis and ensuring the data is collected, delivered, and processed in accordance with the project SLT.* Supporting the Director, as a Forensic SME for all active forensic analysis for projects assigned to them.* Responsible for maintaining target utilization that comes from client billable work including forensic analysis, participating in client update or forensic scoping and update findings calls, client correspondence related to forensic analysis, data collection, or investigative questions verbally or in writing.* Client facing when needed to assist on forensic update calls to ensure accurate updates are conveyed as they relate to the investigation.* Communicate both verbally and in writing to answer client and counsel questions related to the forensic investigation.* Support the IR Director with delegating and managing the Senior Analysts and Analysts who report to Forensic Lead.* Conduct performance reviews of all forensic analyst direct reports.* Maintain a case load of at least two cases for which we conduct forensic analysis. The case load will be maintained alongside the Forensic Lead’s other responsibilities duties.* Conduct final review of the report from the perspective of the forensic investigator ensuring all possible investigative questions were addressed in the analysis and requesting additional context or analysis when the report requires more work.

Boca Raton, Florida, Us

Martinsburg, Wv, Us

As a Forensic and Malware Analyst for the Veterans Affairs NSOC, I am responsible for performing post mortem forensic analysis as well as malware reverse engineering. My current job duties include: • Utilize EnCase and 3rd party forensic tools to perform computer forensic services in support of designated cybersecurity investigations, and documentation • Conduct forensic evidence collection and maintain chain of custody for all digital evidence in accordance with NIST, VA and OMB standards • Provide targeted attack detection and analysis, including the development of custom signatures and log queries and analytics for the identification of targeted attacks • Utilize security tools to include Splunk, McAfee ePO and SIEM to correlate and analyze network sensor data with host forensics • Produce technical analysis reports including root cause analysis summarizing analyzed hosts and/or artifacts discovered during incident investigation and research, forensic evidence collected, proof of chain custody adherence, etc. • Maintain and provide operational support for deployment of EnCase Enterprise, and administration and management of components for VA computer forensics laboratories • Perform in-depth dynamic and static file analysis as well as reverse engineering to determine the nature of unknown or potentially malicious files found during investigations • Collect malware artifacts safely for analysis and incident investigations • Perform URL/domain analysis to identify and report any malicious indicators associated with the resource and evaluate associated risks • Manage, operate and maintain the VA malware analysis lab isolated from the network and ensure 100 percent containment • Use Open Source intelligence (OSINT) to research vulnerabilities in support of cyber related incidents • Produce technical analysis reports summarizing malware analysis support provided and recommendations for remediation

Huntsville, Al, Us

As a Forensic and Malware Analyst for the Veterans Affairs NSOC, I am responsible for performing post mortem forensic analysis as well as malware reverse engineering. My current job duties include: • Utilize EnCase and 3rd party forensic tools to perform computer forensic services in support of designated cybersecurity investigations, and documentation • Conduct forensic evidence collection and maintain chain of custody for all digital evidence in accordance with NIST, VA and OMB standards • Provide targeted attack detection and analysis, including the development of custom signatures and log queries and analytics for the identification of targeted attacks • Utilize security tools to include Splunk, McAfee ePO and SIEM to correlate and analyze network sensor data with host forensics • Produce technical analysis reports including root cause analysis summarizing analyzed hosts and/or artifacts discovered during incident investigation and research, forensic evidence collected, proof of chain custody adherence, etc. • Maintain and provide operational support for deployment of EnCase Enterprise, and administration and management of components for VA computer forensics laboratories • Perform in-depth dynamic and static file analysis as well as reverse engineering to determine the nature of unknown or potentially malicious files found during investigations • Collect malware artifacts safely for analysis and incident investigations • Perform URL/domain analysis to identify and report any malicious indicators associated with the resource and evaluate associated risks • Manage, operate and maintain the VA malware analysis lab isolated from the network and ensure 100 percent containment • Use Open Source intelligence (OSINT) to research vulnerabilities in support of cyber related incidents • Produce technical analysis reports summarizing malware analysis support provided and recommendations for remediation

Vienna, Virginia, Us

As a senior analyst, I am the primary SME for Splunk and the FireEye suite. My duties are to act as an escalation point to Tier 1, perform network forensics and analysis as well as provide guidance to junior team members. My current job duties include: • Provide in-depth analysis of potential intrusions and of tips forwarded from other security team members, constituents and stakeholders • Utilize internal and third party intelligence to seek threats and intrusions within the network • Perform cyber intel fusion by extracting data from intelligence and synthesizing it into new signatures and alerts • Execute countermeasures such as DNS sinkholes and system quarantining • Provide analysis on forensic artifacts • Perform dynamic malware analysis • Author and implement signatures for IDS/IPS, SIEM and other sensors • Perform in-depth network and memory forensics • Build dashboards based on investigation techniques and operationalize for Tier 1 • Develop standard operating procedures (SOP) and knowledgebase articlesACCOMPLISHMENTS AND PROJECTS • Designed and implemented the NIH Tabletop Exercise • Was acting team lead on two separate occasions. During this time, I have managed a team of 5 and a team of 9 Tier 1 and Tier 2 Security Analysts. • Member of team responsible for restructuring of the NIH Security Operations program • Assisted in the design of the NIH Incident Response framework • Developed training program for Tier 1 Security Analysts • Member of team responsible for deployment of FireEye NX and HX • Assist in the deployment of Palo Alto URL filtering

Vienna, Virginia, Us

Contractor- National Institutes of HealthAs a Tier 1 analyst, my job is to act as incident response coordinator as well as to monitor alerts obtained from the IDS, third party intelligence and the various institutes that we support. Duties performed include: • Provide initial analysis and triage of security incidents as obtained from tips, incident reports, and requests for CND services from constituents received via phone, email and ticketing system • Review logs for suspicious events and escalate to Tier 2 • Perform static malware analysis on suspicious artifacts • Coordinate incidents for affected constituents to gather further information about an incident, understand its significance, and provide guidance on required actions • Implement countermeasures such as blocking indicators of compromise or host IP at boarder firewall, disabling Active Directory accounts, email and VPN accounts • Escalate investigations/incidents to Tier 2 or Subject Matter Experts • Report lost or stolen equipment as reported by constituents • Answer requests for information from constituents as it relates to CND services

Falls Church, Va, Us

Contractor- National Cancer Institute/ National Institute on Drug Abuse• Serve as team lead for the three NIDA Helpdesk technicians. • Act as POC for team and Information Resource Management Branch (IRMB) regarding Mac, Network Access Control, Personal Identity Verification (PIV), Malware Remediation and Tier 3 escalation. • Perform diagnostic tests using various tools. • Support installation, maintenance, and troubleshooting of hardware, software and network issues. • Assisted in the creation and maintenance of the Standard Operating Procedure. • Act as POC to the Infrastructure Team with regards to NIDA’s networking equipment. • Train new NIDA Helpdesk Technicians. • Image and deploy new laptops and desktops

Gaithersburg, Maryland, Us

Contractor- National Cancer Institute/ National Institute on Drug Abuse• Performed diagnostics using various tools. • Supported installation, maintenance, and troubleshooting of hardware, software and network issues. • Imaged and deployed new laptops and desktops. • Assisted in the creation and maintenance of the Standard Operating Procedures. • Installed and maintained network-managed devices. • Served as team lead for six-person team at the NCI call center. • Managed employee shift hours. • Approved computer rebuilds upon data verification. • Perform Tier 1 technical support via phone and email. • Led various projects for the call center team. • Acted as POC and operator of the 6116 Executive Blvd Lifecycle Workstation, assisting users with PIV card pin resets, certificate renewals, and PIV card troubleshooting. • Provided phone support to end users, assisting in account-related issues in Active Directory.

• Performed diagnostics using various tools; support includes but not limited to assisting with print issues, install, maintain, modify and troubleshoot hardware and software systems. • Installation and repair of computer software and hardware. • Provide research and recommendations on software and hardware. • Designed and implemented Information Security Policy compliant with SEC, FINRA, and HIPAA requirements.