Tim Duckworth Email & Phone Number

Virginia, United States

Herndon, Virginia

Mclean, Va

Primary function is to provide custom integration solutions across all Cyber Security tools▪ Subject Matter Expert in Insider Risk Management AKA Insider Threat Programs with a solid understanding of currenttechnologies used for baselining human behavior models and a proven expertise in presenting the most effective means ofemploying Insider Risk Program toolsets to upper management, through Microsoft’s PowerPoint Presentations and online WebExmeetings.▪ Pivotal member of the Booz Allen Hamilton Information Services Computer Incident Response Team (CIRT) which is theexemplar international collaborative cyber incident response team. Providing code and programming interface support for thepurposes of integrating all of the toolsets used by the CIRT.▪ Employed MongoDB, and Python code to upgrade the Booz Allen Hamilton CIRT indicators of compromise database (CRITS)implementation.▪ Utilize HTML, MongoDB, Python Code, and PowerShell programs to generate custom solutions to eliminate gaps in visibilitybetween the current toolsets used by the Booz Allen Hamilton CIRT. Pioneered a custom DNS Sinkhole to monitor allconnections made by employees to “known malicious sites” on the Internet, and integrated it with Nitro to generate alarms whenBooz Allen Employees attempt to access known malicious websites. The custom solution was created by using an open sourcetool called InetSIM. With a custom Python script, the logs were reformatted for proper ingestion to Splunk and McAfee ESM/Nitro.▪ Led multiple meetings/sessions for engineering new solutions, enhancing capabilities, and troubleshooting existing problems

Created and maintain the Cyber forensics capability for FEMA by writing procedures and flowcharts, purchasing equipment [Forensic workstations and servers (deployed EnCase Enterprise and FTK)], and setup a secured lab for performing analysis.Continuously improving efficiency of the SOC through batch files and scripts (primarily in PowerShell) to automate collection of indicators of compromise and other job functionsConduct risk assessments and collaborate with clients to provide recommendations regarding critical infrastructure and network security operations enhancements.Deployed and Manage the Enterprise Network Intrusion Detection System (SourceFire/CISCO), creating and deploying new rules from Tactics, Techniques and Procedure (TTPs) reports while keeping the system updated with the most current rule sets and patches.Design, publish, and maintain FEMA Cyber Incident Response procedures in accordance with DHS guidance and assist in the writing and review of organizational security policies to support contingency planning & testing, Security Awareness, intrusion detection, Patch Management, Anti-Virus, etc.Lead in responding and mitigating security events, Malware and forensic analysis incidents, and classified data spillage while coordinating with other branches in FEMA, DHS and it’s other Components Lead in, involving all mobile and static computing devices such as smartphones, laptops, virtual machines, etc.Drafting of “All Hands” security awareness and education communicationsManage the incident response and investigative duties for FEMA. Coordinate multi-departmental responses to information security events including events within the DHS (Department of Homeland Security) infrastructure

Network Engineering And Management

High School Diploma