Tim Lansing Email & Phone Number

• Collaborated with other cyber defense teams to understand their needs and obtain feedback on the CTI team’s ability to satisfy their needs when providing technical reports and information involving TTPs, YARA/Snort rules, etc.• Reviewed domain monitoring alerts involving potentially malicious domains and analyzed the domains. Submitted blocks for all potentially malicious domains and requested domain take-downs when evidence of malicious use was available and able to be provided to the domain registrars.• Created a Python script to read a CSV file received weekly from the National Cyber Collaboration Center, group indicators listed by threat actor group, and add each group’s indicators to their MISP (Threat Intelligence Platform) event.• Created a Python script to check for new CVEs by vendor, get the CVE’s information, and add it to a CSV file if the CVSS score was 7.0 or higher.• Configured VisualPing to monitor over 30 vendor website vulnerability announcement pages, perform checks twice a day, and send email alerts if changes were noticed.• Wrote Intelligence Advisories and Vendor Reports on current topics that meet corporate customer Priority Intelligence Requirements.• Documented a process that uses XSOAR to automate the ingestion of domain monitoring alerts, obtain information for the alerted domains, and have the information presented in a ticket for CTI Analysts to analyze and action.• Created How-To guides outlining daily tasks for Domain Monitoring and checks of newly announced vulnerabilities.• Instructed CTI Analysts on technical skills related to Notepad++ macros, GitHub, Splunk, scripting and more.• Received three RStar awards within a four month period providing recognition for accountability, innovation, and collaboration in work performed including domain monitoring and Python scripting automation.

Cedar Rapids, Iowa, United States

Instruct network administration and cybersecurity courses for Kirkwood's Business & IT department.

- Worked with clients to identify and make Security Operations Center and Incident Response improvements and proposed scenarios and solutions to address these areas of improvement.- Consulted with clients on information security best practices and guided them toward cost-effective strategies for implementing security.- Evaluated information security risk, considering the customer business environment and industry requirements.- Advised cybersecurity leadership of multiple large organizations of the impact of various vulnerabilities. Using tools, such as Qualys, provided recommendations regarding prioritizing resources used to remediate vulnerabilities identified by their vulnerability management programs.- Developed policies, procedures, and standards to outline cybersecurity strategies and tactics aligned with frameworks matching their area of business.- Performed Zero Trust cybersecurity assessments, enabling organizations to understand their current state and allowing them to develop a plan to align with the Zero Trust Maturity Model.- Assisted multiple customers with active cybersecurity incidents to assess their capabilities, identify gaps, and make environmental changes to better protect their devices, data, and networks.- Set up MISP, a Threat Intelligence Platform, to collect indicators of compromise for a Security Operations Center and used Python to script the sending of these indicators to a SIEM for further use and alerting.- Planned and performed Tabletop Exercises to improve operations of Security Operations Centers.

Cedar Rapids, Iowa, United States

- Planned, communicated, coordinated, and conducted incident response activities.- Wrote Incident Response reports assessing actions performed by actors compromising systems, summarizing their activities and impacts to Collins for non-technical audiences, and provided lessons learned, including solutions to mitigate similar incidents in the future.- Designed and created a virtual lab environment following the Purdue Model for Industrial Control System security to allow for testing various security setups and cybersecurity attacks involving operational technology and factory environments.- Provided risk briefings to senior management on incident response findings and developed remediation approaches and recommendations to improve cybersecurity.- Trained Incident Responders to prepare them for when an incident arises.- Conducted forensic analysis and basic static and dynamic malware analysis.- Government Secret Security Clearance.

Cedar Rapids, Iowa, United States

- Automated work using scripts, including a PowerShell script created to capture a memory image, create a file timeline, and collect artifacts expediting initial analysis of devices as their drives are gathered and shipped for detailed review.- Provided threat intelligence collections and reporting support by researching threats and reviewing reports from open-source news and various Information Sharing and Analysis Centers (ISACs). Aggregated these indicators with ones discovered internally in the company’s malware and threat repository and used this knowledge to perform searches locating previously unidentified threats in the company’s environment.- Facilitated the production, collection, tracking, and reporting of Security Operations Center metrics.- Served as an Information Systems Security Officer (ISSO), ensuring proper security measures are followed regarding classified assets and restricted spaces held by the Incident Response Team.

- Utilizing various tools, analyzed alerts. Prioritized, worked, and escalated incidents arising from alerts requiring further analysis or forensic investigation.

Cedar Rapids, Iowa Area

- Created custom forms, reports, and subroutines using proprietary versions of Unidata and Unibasic.- Created API calls written in C# utilizing ASP.NET Web API 2.0.- Automated tasks via Powershell scripts.

Cedar Rapids, Iowa, United States

- Configured, documented, and managed a Windows 2012 R2 Deployment Services server and its use in imaging workstations with Windows 7 and Windows 10 operating systems.- Upgraded servers and software while following a change management process which ensured all steps were thoroughly documented and actions communicated to the affected individuals.- Created reports on operating system and software updates, correcting any deficiencies identified.- Resolved all incidents and requests received in a timely manner while maintaining open and effective communication with customers.

Marion, Iowa, United States

- Monitored client and internal networks using available tools.- Logged all activities into the incident management system.- Ensured incidents are closed in a timely fashion with verification of customer satisfaction.- Continually looked for opportunities to improve service to the customer.- Participated in special projects as needed and defined, meeting all time-lines.- Assisted with documenting and updating departmental procedures and work instructions.

Camp Lejeune, Nc

Advised higher-level management on and implemented radio, telephone, and computer networks by managing a team of 55 to 65 Marines in domestic and remote environments.

Monitored, collected, transcribed, and analyzed intercepted target communications.

Graduate Certificate, Cloud Security

Master'S Degree, Information Security Engineering

Graduate Certificate, Computer And Information Systems Security/Information Assurance

Certificates, Java, .Net, Database Technologies, Network And System Administration,

Associate Of Arts (Aa), Chinese - Mandarin

Bachelor Of Arts (Ba), Accounting, Spanish, Certificate In Portuguese Studies