Thomas K. Email & Phone Number

Paris, Fr

Grand Prairie, Texas, Us

● Stood up Cybersecurity program from Green Field state● Wrote Policy Process and Procedural documentation, to include Business Continuity Plan, DisasterRecovery, Risk Acceptance, Incident Response, and day to day Process/Procedure on numerous securitytechnologies● Led team of 8 Analysts and Engineers along the following verticals:Monitoring Platforms, Incident Response, Threat Hunting, Security Assessments, Penetration Testing,Red Team, Blue Team, Vulnerability Management, Asset Loss Prevention, Firewalls, EndpointManagement, API Security, OT Security, Cloud Security, DLP, Vendor Management, Email Security,Security Awareness Training, Legal Interaction, PAM/IAM● Active role in in Architectural Review Board and Change Management strategy and planning.● Managed MSP for further staff augmentation on Tier1/Tier2 Security Operations, Engineering, and Vulnerability management

Stood up Fusion Center from Green Field State, for StartupBuilt teams for Incident Response, Security Engineering, Threat Intelligence, Security Architecture, GRC, Insider ThreatManaged MSP/MSSP for Tier1/Tier2 Incident Response and SOC TriageManaged team of 4 Engineers and Analysts to develop internal capabilitiesMaintained Relationships with all vendors and internal cross-department functionalityCreate Cybersecurity Education program for company-wide ingestionBuild metrics and KPIs for senior leadershipPerformed insider threat investigations as needed.

Atlanta, Ga, Us

Senior SOC Engineer with a current focus on security tooling, tuning, maintenance, and integrations.● Lead team of 3 Engineers in maintaining the SIEM and SOAR platforms● Spearheaded migration from QRadar to QRoC (QRadar on the Cloud)● Assisted with MITRE ATT&CK Framework adoption to Sysmon Ruleset within QRadar● Assess, prioritize and take action on requests that improve existing Security Operation Center tools andprocedures● Partner with senior management to coordinate security incident response efforts to communicateinformation, drive resource actions and decisions, provide recommendations, and ensure resolution● Evaluate and analyze complex malicious code through the use of tools including disassemblers,debuggers, hex editors, un-packers, virtual machines, and network sniffers● Conduct reverse-engineering for known and suspected malware files● Investigate instances of malicious code to determine attack vector and payload, and to determine theextent of damage and data exfiltration● Produce reports detailing attributes and functionality of malware, and indicators that can be used formalware identification/detection, to include behavior, identified infrastructure used for command andcontrol, and mitigation techniques● Analyze the relationship between a given sample of malware and other known samples/families ofmalware, and notable features that indicate the origin or sophistication of the malware and its authors

Atlanta, Georgia, Us

● Lead team of 9 analysts in day to day SOC Operations● Wrote technical documentation on existing and future tools.● Assist management in defining Policy and Procedure.● Wrote playbooks and runbook, enhancing process and procedure maturity level● Held Daily Standups, facilitate daily turnover calls between multiple SOCs worldwide● Facilitated communication between Silos, built bridges while enhancing efficiency and effectiveness of security practices.● Implemented Veris Framework documentation methodology, utilizing NIST 800 171/61/53 and Picerl.● Stood up a ticketing system, following SOC2.2 guidelines.● Assist analysts with their investigations.● Train analysts on existing and future tools, policy, procedure.● Back up to management when needed.● Perform deep dive analysis on security incidents, on an as-needed basis.● Perform QA for Tier1 Analysts, with weekly 1on1’s to upskill.● Define, Create and Build Procedures and Documentation on DLP process prior to hand-off.

Armonk, New York, Ny, Us

Working within a SOC environment, and Maintained position as MSS Threat Analyst/Cybersecurityanalyst, monitoring multiple worldwide customers in Retail, Financial, Medical, and Big Data sectors.Using QRadar for event correlation and analysis, alongside Remedy and Soc Console (SIEM Proprietary to IBM, integrates with QRadar, Remedy, and VSOC Portal on the customer end), to analyze andescalate threats as well as propose solutions, as specified by customer needs per contract. Overallobjectives were to provide 24/7-365 Global “Eyes On Glass” monitoring solution for both Managed andUnmanaged security services customers, responding within SLA’s, while maintaining a 3 out of 5 qualityrating scores (my average is 4.5) by customers and 85%+ (My average is 95%+) internal scoring onescalations.● Analyzed log files within QRadar, and Soc Console (proprietary SIEM to IBM), utilizing thecustomers network infrastructure to provide solutions to vulnerabilities● Assist in mitigating ongoing threats to files and data, all while maintaining compliance withinSarbanes Oxley, PCI, or HIPAA respectively.● Assisted with several special projects, Remedy UAT v9.1 trial, Havyn Project and SecondScreenExperience project, from incubation to production rollout, alongside continual QA on said projectswhile in use. All with the expressed missions to minimize pivot time between tools, and enhancethe Analyst Experience.● Performed trending analysis, monitoring for and predicting ‘spikes’ in event counts for customers,to ensure we had enough analysts on hand to handle any eventuality.● Creating PCR’s (Device and Rule tuning tickets), reducing false positives, which optimizes bothtime on glass experiences with Analysts, and allows for more effective analysis of legitimatesecurity concerns.● Sent overseas (India, Costa Rica) to stand up and train the Remote SOCs

Atlanta, Georgia, Us

● Level 3 Helpdesk support on proprietary Dental Practice Management Software Platform.● Level 2 Helpdesk support on proprietary Orthodontic Practice Management Software Platform.● Utilize Bomgar, PCAnywhere, to connect remotely to clients to resolve complex SQL, software, hardware, and networking related issues.● Assist in special projects regarding RMA status’ on digital sensors, beta testing Bomgar appliances, beta testing VDI● Consistently update and maintain group knowledgebase with new data, to assist in maintaining a high-consistency of knowledge in our software.● Subject Matter Expert on Fingerprint Module, Plugin Module, Dental Imaging Module, Dual Database Module, Dental Chart Module, and Kiosk Module for Practiceworks Software.

● Level 3 Helpdesk support for remote transcriptionists, and underlying systems.● Level 2 Helpdesk support for major Hospital chains, on proprietary transcription services.● Utilized PCAnywhere, LANDesk, and NetSupport to connect remotely to customers.● Used Cisco, Remote Desktop and RAS to connect to client servers via 12 separate VPNSoftwares.● Maintained print servers for client facilities, installed proprietary printing software for transcription● services, while keeping in compliance with HIPAA and Sarbanes Oxley regulations.● Assisted in special projects to keep all Internal and Customer server platforms to standardized● specifications. (Server 2000 > Server 2k3 Project, SAP migration, Lotus/Domino upgrades).● Subject Matter Expert on assisting Sight Impaired employees utilize and troubleshoot hardwareand software over the phones.● Sent overseas to Bangalore to train remote Support team.

● Upgraded and installed all new software/hardware for endpoints and users.● Performed Administrative duties and maintained the network (30+ workstations)● Repaired and Tested Desktops, Laptops, Laser and Dot Matrix Printers (Dell, HP, Commpaq,Lenovo, IBM, Toshiba, Okidata)● Upgraded and refurbished Desktops and Laptops for resale and reuse.

High School Diploma

Computer Science