<([^\/][^>]+)>(.*?)<\/[^>]+>dt="2021-02-08">selected CyberArchitecture Security configuration, automation and SIEM

USNR IP Officer (1825)Prior Service/Active Duty EM 1999-03 | SELRES 2004 - CurrentAssignments: CPF | NAVWAR | MSRON | USS Juneau LPD-10 7th FleetAdvanced Fire Fighting School, Tactical Combat Casualty Care (TCCC), Nav/RT, Information Warfare (IW)Navy E-Core and EM 'A' school- Power generation, motors, controllers and distribution- Circuit and schematic design- Solid state electronics- Solid state logic circuits- basic digital circuits- basic binary and hexadecimal application

Designs system security environments for enterprise, enclaves or the enterprise to include requirements definition, risk assessment, systems analysis and design, security test and evaluation plans, systems hardening, and business continuity planning. Provides analytical support for security policy development. Ensures stakeholder security requirements necessary to protect the organization’s mission and business processes are adequately addressed and documented in reference models, segment and solution architectures, and the resulting systems. Designs and evaluates enterprise information system security throughout the systems development life cycle. Integrates new architectural features into existing infrastructures, designs cyber security architectural artifacts, provides architectural analysis of cyber security features and relates existing system to future needs and consults on integration and testing issues. May liaise with appropriate internal and external governance bodies or regulators to evaluate cybersecurity risks and vulnerabilities in the context of new or unique security architectures. Develops solutions with but not limited to: Splunk, Tenable/Nessus, SEP, AD, Centrify, Ivanti, Innerview/Forcepoint. Experience with PowerShell, Bash. Dislikes: YAML. Any system that starts with "legacy".

Investigates anomalous network activity, and responds to cyber incidents within the network environment or enclave. Collects data from a variety of tools, including intrusion detection system alerts, firewall and network traffic logs, and host system logs to analyze events that occur within their environment. Provides persistent monitoring of all designated networks, enclaves, and systems. Interprets, analyzes, and reports all events and anomalies in compliance with company policy and external regulations. Continuously works to tune security tools to minimize false positives and maximize detection and prevention effectiveness. Collaborates with the owners of cyber defense tools to tune systems for optimum performance. Analyzes malware and attacker tactics to improve network detection capabilities. Collaborates with external companies or government agencies to share open source or classified intelligence. Distributes vulnerability and threat advisories to identified consumers and may set mandatory remediation timelines.

Responsible for creating Security Authorization (Formerly C&A) packages and perform Annual assessments, re-authorizations to include vulnerability scanning, interviews and system testing. Working with a variety of stakeholders, including System Owners, implementation engineers, System Admins, Networking teams and the organizational security team to develop deliverables, recommend security solutions, and maintain the existing Authority to Operate (ATO).*CompTIA Security +, Splunk PowerUser, Splunk Admin* Support the analysis and review of information security programs and systems to ensure compliance to Federal security policies.* Independently develop a variety of Security Authorization deliverables including: System Security Plans, Risk Assessment Reports, Privacy Impact Assessments, Annual Assessments, POAMs etc.* Analyze existing processes and procedures to determine areas of possible improvement that will lead to gains in efficiency and security.* Provide guidance on security threats, technology, standards, and practices.* Develop and review organizational security policies.* Preparing and analyzing test results to develop into a POA&M for engineering review.* Interface with the Information Systems Security Manager, Program Engineering staff and Classified Lab Managers to ensure adherence to all NISPOM Chapter 8 policies* Hands on Splunk dashboard and panel development, data inputs, field generation and operation experience including non-windows systems.