As a Distinguished Engineer – Detection Engineering, I’m responsible for leading and participating in threat research campaigns, from identifying emerging threats and designing adversary emulation tests to leading detection research and aiding in the implementation of effective remediation. I play a crucial role in developing and enhancing threat detection capabilities by conducting the following:Creating detection logic tailored to the enterprise threat landscape using industry-specific intelligence and developed use casesRefining and optimize detection rules, signatures, and alerts in collaboration with other cybersecurity teams.Conducting comprehensive analysis of threats and vulnerabilities, profiling threat actor behaviors, and develop threat indicators.Executing realistic attack scenarios to assess the resilience and detection capabilities of internal systems and processes.Evolving and implementing advanced detection mechanisms for emerging threats.Developing and implementing novel threat hunting and detection engineering procedures and methodologies.Delivering comprehensive and accurate reports and presentations for both technical and executive audiences.Providing insights and recommendations to improve security controls and mitigation strategies.Collaborating in purple team exercises to bridge the gap between offense and defense.Maintaining current knowledge of the latest cyber threats, vulnerabilities, and TTPs, and communicate this information to appropriate teams within Verizon.

Author of The TTP Pyramid.Top 20 Sigma Contributor.Top 10 LOLBAS Contributor.BlackHat Course Author & Instructor.DEFCON Adversary Village and Red Team Village Workshop Instructor.

Authored the TTP PyramidConduct adversary and threat research. Collect and process intelligence via extraction of procedures mapped to MITRE ATT&CK tactics and techniques. Review procedure level intelligence and develop emulation plans based on adversary procedures. Manage, design, and engineer detections based on threats and emulation development.

Senior Level Tier 3 SOC Analyst, Directed Threat Hunting, Consultant, Cyber Threat Intelligence Analyst, Incident Responder, and Detection Engineer.

SANS Facilitator for SEC501 Advanced Security Essential - Enterprise Defender at SANS 2018 in Orlando, Florida. Assisted instructor Paul Henry in teaching, coursework, labs, and troubleshooting.

Managed a 99.99% uptime environment with multiple data centers. Oversaw networking devices such as firewalls, routers, switches, and IDS/IPS solutions. Managed compliance for HIPAA and EHNAC standards for network information systems. Assisted in coordinating change management for test and production environments. Assisted in Server administration, including hyper converged solutions, virtualization, and backups.

Managed the patch management solution. Managed vulnerability scanning and reporting solution. Managed the Data Lost Prevention Management (DLP) Solution and remediation. Other responsibilities included Firewall Management, Help Desk, & Networking.