Stephen Mathews Email & Phone Number

Plano, Texas, Us

Configures and monitors security software focused on threat hunting and vulnerability analysis to protect intellectual property in the R&D organization. Appointed Windows Subject Matter Expert, responsible for triaging alerts on Windows servers and clients. Communicates across teams for a coordinated response to research, validate, and close vulnerabilities. Sources open source threat intelligence to predict and focus risk mitigations. Utilizes multiple security products and tools including Splunk, Tanium, Qualys, and CrowdStrike Falcon; plus scripting capabilities to automate API calls and reports.

Brooklyn, New York, Us

Teaches real-world cybersecurity and information security processes, techniques, and capabilities using cross-platform tools. Facilitates interactive learning workshops and team activities. Contributes to ongoing curriculum development, including lesson plans. Directly mentors and develops instructional assistants in technical abilities and industry knowledge. Performs mock interviews and provides guidance on jobs and positions within the cybersecurity industry. Prior students in my classes have achieved Security+ certifications and have attained employment in their new industry.

Washington, Dc, Us

Moved into a dedicated Vulnerability Management role. Leading the transition from Qualys to Tenable Nessus vulnerability management solution. Designed scanning configurations and scanner placement to enable daily authenticated scans of all assets. Organized assets into departmental groups for scorecard reporting. Audited tools and agent deployments to ensure maximum coverage, deploying agents as zero-touch remote installs to true-up coverage and maximize product ROI. Uses RSS feeds from CISA, NCSC, ACSC, MS-ISAC, REN-ISAC, and security vendors to stay informed of current threats and trends. Drove reporting for log4j identification and response using all available security platforms to include CrowdStrike and Tanium. Wrote bash and PowerShell scripts to remove the JNDI classpath from individual server log4j-core JAR files. Single-handedly stood up FullHunt log4j-scanner using GitHub and scanned over 2k websites. Combined and normalized data from 6 sources to create a comprehensive single tracking document of findings, mitigations, and remediations. Used Splunk to find JNDI requests from web server HTTP logs to identify servers specifically targeted with attacks for priority remediation.

Washington, Dc, Us

Promoted into the Security Team with the responsibility of designing and building Georgetown University’s Vulnerability Management Program, incorporating a Vulnerability Response Group, and responsible for reporting upon the efficacy of the university’s patch program. Designed both an asset and a vulnerability criticality scoring metrics to determine a risk-weighted vulnerability response window per vulnerability. Assisted design of user impact score and implemented data risk scores for devices. Scripted processes to decrease external attack surfaces by first pulling public DNS and IP data from Shodan and BinaryEdge and then running it through security scanning tools such as Tanium, Detectify, and Qualys. Splunk training and usage for threat hunting and incident response procedures through to completion using custom playbooks, recorded in TheHive. Mapping threats to MITRE ATT&CK framework and using NIST Cybersecurity Framework to protect and respond to incidents. Additionally, performs Security Reviews of vendor service proposals, approves firewall and VPN requests, and participates in Change Management programs as a Security Operations representative.

Washington, Dc, Us

One of two engineers directly responsible for all Microsoft Windows Server operations of Georgetown University and associated schools to include the Law Center and Business School. Performs monthly, automated Operating System patching using System Center Configuration Manager (SCCM). Prevents configuration drift between server builds by using Active Directory (AD) Group Policy Objects (GPO) and SCCM Desired Configuration Management (DCM). Automates server builds in VMware and Amazon Web Services (AWS) using PowerShell scripts and Terraform configurations with Salt minions. Maintains script lifecycle development by utilizing local Git repositories. Created one-way, external Forest Trust between GU and Law Center for centralized SCCM management. Updated AD Sites and Services to reflect physical deployment of data center and cloud services, to enable AD Domain Controllers in AWS. Developing AD forest recovery procedure for Forest and Domain Functional Levels (DFL/FFL) upgrades. Performs root-cause analysis on server memory dumps (Bugcheck/BSOD), monitors server performance counters for advanced tuning, and collects network traces to aid troubleshooting.

Robins Afb, Ga, Us

Supervises, manages, mentors, leads, and builds effective teams to introduce new Airmen and help prior-service members transition into this Air Force Reserve unit. Directly supervises and rates personnel. Expected to resolve conflicts at the lowest level, mentor subordinate supervisors, identify personnel issues and assist them to completion. Advises leadership on issues and translates leadership ideas and vision into actionable tasks for execution. Responsible for ensuring all resources, including personnel, are used effectively and efficiently.

Reston, Va, Us

Performed phishing analysis and reported malicious websites to network owners. Initiated domain takedowns for malicious and copyrighted websites and domains across world-wide hosting providers using APIs and direct-contact methods. Investigated assumed identities on social media websites and directed removal of fake profiles for our clients. 24-hour SOC environment with 8-hour shifts.

Redmond, Washington, Us

Dedicated support engineer for numerous federal agencies across the Microsoft National Security and Federal Civilian groups. Provided direct onsite technical support and leveraged Skype for Business for remote support to ensure prompt responses. Viewed as a Trusted Advisor to the customer; regularly attended customer meetings to understand points of frustration within their business and provide technical and process solutions to address those issues. Worked alongside customer and remote Support Engineers to see Microsoft cases through to completion using company-wide resources. Provided technical documentation to customers and their System Integrators for implementing Microsoft products and services within Best Practices. Maintained projects and tasks with Points of Contact to ensure consistent forward momentum. Expected to find opportunities for follow-on deliveries to achieve customer vision and grow business. Responsible for managing own time and balancing the customer contract hours to ensure reliable coverage and full Return On Investment of purchased support hours. Published in Ask Premier Field Engineering (PFE) Platforms TechNet blog and featured in 3-segment “PowerShell Basics” videos on Taste of Premier MSDN blog. Overall, delivers onsite, remote, and dedicated support services to promote world-wide healthy customer IT environments.

Horsham, Pennsylvania, Us

Directly supervises and responsible for day-to-day operations of 15-person military intelligence shop supporting DC ANG F-16 flying operations. Schedules manpower coverage for all products and services needed daily. Deconflicts variety of personal and professional issues to smooth duty performance. Escalation point for personnel issues and provides professional mentorship. Writes both performance reviews and adverse administration actions. Quality checks all products provided by work center. Creates all-source intelligence products for flying and base operations of the DC ANG. Prepares and gives Pre-Mission Briefs (PMB) for flying personnel. Performs debriefs and creates Mission Reports (MISREP) for after-actions review. Prepares and gives Current Intelligence Briefs (CIB) and Threats-of-the-Day (TOD) prior to deployment and for any customer requests.

Tampa, Fl, Us

One of two System Administrators specifically tasked with maintaining the Windows network, to include Active Directory, Group Policy, Account Management, Operating System troubleshooting and application support. Environment consists of a mix of physical and virtual machines; has 5 Domain Controllers (1 virtual), Server 2008 R2 domain and forest functional level, 50+ member servers, and 300+ user accounts.

Reston, Va, Us

One of two systems engineers that maintain a complex trusted gateway between four TS/SCI networks that allows up/down cross-domain (CDS) data transfers while maintaining security to the individual program level, coupled with a DTW user interface allowing the display of multiple security levels and networks on one screen. Accomplished two system/network accreditations: one for the TGS cross-domain solution and the second for a PL-3 secured Windows network. Spear-heading the replacement of Windows Server 2003 domain into an entirely virtualized domain using VMware management and NetApp vFiler network storage. Domain is a PL-3 accredited, native Windows Server 2008 R2 that consists of Active Directory (AD), DNS, Remote Desktop Services (RDS, formerly Terminal Services), Exchange, SQL Server 2008 R2, and customized data import solutions. Also administrates and maintains Unix based systems to include Solaris 10 (DTW), Red Hat Enterprise Linux (TGS), and for several border servers.

Reston, Virginia, Us

One of two Windows Systems Engineers directly managing 265+ servers for the Department of State (DoS) Human Resources bureau IT operations department directly servicing all DoS employees worldwide. Environment is 99% virtualized and managed remotely on six VMware ESXi 4.1 hosts remotely located. Hosts are 99% Windows Server 2008 R2 with IIS 7 and SQL Server 2008. Heavy developer interaction; directly assisting developers in migrating applications from Development to Test to Production environments. Performs data replication and ensures no data loss between environments. Troubleshoots any issues encountered by developers on servers and implements fix actions. Engineers, deploys, manages NetIQ AppManger agents and job solutions to monitor and ensure environment is 100% operational. Currently running 2,000+ jobs on all servers; it collects performance metrics, monitors key services, and checks our own web URLs to identify problems before there is a customer impact. Also uses DoS Diplomatic Security tools (iPost) to ensure member servers have latest patches, antivirus updates, account password settings, and additional items are updated and configured correctly. Uses iPost and SMS to push monthly patch bundles to member servers. Directly responsible for ensuring 100% connectivity to SMS and Symantec management servers for iPost reporting.

Mclean, Va, Us

Sole system engineer/administrator for three separate DoD Windows domains supporting 500 local and remote users; includes Windows Server 2008/2003, Active Directory/Exchange, Windows 7, and XP. Maintains a total of 4 domain controllers/DNS servers, 1 Exchange 2010 server, 7 web servers, 2 Oracle database servers, 4 NAS file servers, and 1 backup server. Creates and deploys GPOs in multiple OUs in Active Directory (AD). Configures and maintains CheckPoint hardware firewall and Dell 5224 switches. Performs scans using Gold Disk and Retina; applies patches and mitigates vulnerabilities to comply with DISA STIGs. Cloned 5 production servers into a virtualized environment using VMware ESXi 4.1, vSphere, and vCenter, creating a test network. Uses test network to ensure new security policies don’t interfere with production systems. Designed and implemented daily network backup for 400+GBs of data using ArcServe backup.

Randolph Afb, Tx, Us

Directly managed a $23mil, enterprise, NIPR/SIPR, Layer 3, 99% Cisco infrastructure with VOIP and Unity voice-mail using IP routing, VLANs and physical configurations. NOC position with a team of 5 engineers supporting 3,000 users plus remote sites. Directly supervised and rated one personnel. Provided direct engineering support to the base server farm. Engineered and installed dual-home circuits for redundancy of 12 key HP blade servers running virtualized Server 2003 servers, including AD, Exchange, DNS, and DHCP. Configured and deployed Catalyst 3548 – 6500 switches with Supervisor Engine 32/720 cards, Cisco 1800 routers, and Cisco VOIP phones and routers. Proactively monitored the entire network using HPOV, CiscoWorks, and SolarWinds. Addressed trouble tickets automatically created by HPOV. Loaded electronic cryptographic keying material on TACLANEs (KG-175), Micros, and Minis using SKL (Simple Key Loader). Maintained life-cycle accountability for all cryptographic and classified materials. Used Remedy TTS to track work progress and update customers.

Randolph Afb, Tx, Us

Member of four person team serving 8,000 users on an enterprise Windows domain. Imaged computers via Sysprep, HD cloner, DVD/CD image, external HD, Ghost image, or Remote Installation Service (RIS) over the network. Installed and upgraded device drivers to improve functionality and security of the client. Troubleshot client computer connectivity to the domain, checking DHCP and DNS status and ensuring GPOs were being processed by the client. Performed preventative maintenance; including removing physical debris from internal components, removing unused user profiles, and performing hard drive defragmentation. Performed hardware/software troubleshooting of user computers, printers, and peripherals. Replaced LCD screens/monitors, hard/optical drives, video/audio cards, and other components. Processed RA (Return Authorizations) with commercial vendors. Accounted for computer systems and hardware via Serial Number and POC information.

Randolph Afb, Tx, Us

Received, distributed, and loaded cryptographic materials for multiple secure WAN circuits and secure voice capabilities supporting 2,900 users. Loaded electronic crypto material into TACLANEs, Micros, Minis, and STEs with SKL and KYK-13. Maintained life-cycle accountability for all cryptographic and classified materials. Provided security awareness training of DoD IA requirements to 900 users

Randolph Afb, Tx, Us

NOC position with a team of 3, a focal point for 3,200 users. Proactively monitored network links and health using HPOV in real-time. Opened trouble tickets for alerts created by HPOV. Provided Tier 1 remote troubleshooting on an enterprise Windows domain using Server 2003 and Windows XP for end-users with optional on-site support. Restarted services for Exchange, DNS, DHCP and checked server event logs for errors. Consistently provided support for MS Outlook and file sharing permissions. Modified user profiles, reset passwords, changed user permissions, and changed MS Exchange mailbox sizes using AD. Troubleshot server/client connectivity ensuring GPOs were properly processed by the client. Created and tracked tickets using Remedy TTS. Processed RAs for warranty repair and performed hardware repair to include changing hard drives and replacing laptop keyboards. Issued and accounted for 25 laptops to remote users.

Randolph Afb, Tx, Us

NOSC position with a team of 4 supporting 42,500 users on multiple enterprise Windows domains. Used NetIQ to proactively monitor Windows Server 2003 systems, checking for free disk space and CPU/Memory/Network utilization. Restarted services for Exchange, DNS, DHCP and checked server event logs for errors. Used HPOV to proactively monitor NIPR/SIPR WAN circuits covering Europe, checking for usage, connectivity status, environmental effects, and other sensors for circuit health. Opened trouble tickets to address automatic alerts reported by HPOV. Created and briefed Service Impact reports using data from HPOV. Provided Tier 2 support to local comm. centers using Remedy TTS to track jobs. Monitored real-time Network Intrusion Detection Systems (NIDS) for 85 separate LANs. Created and briefed Service Impact reports for higher staff.

Associate In Applied Science In Intelligence Studies And Technology, Military Intelligence, General

Education record