Security incident response leadershipPost-incident tactical recovery planning

Reverse engineer: Malware, exploits, and intrusion tool-sets to discover, enumerate, and remove Advanced Persistent ThreatsThreat Hunter: Detect advanced threats and adversaries using Microsoft Azure-enabled security solutions: Microsoft Defender ATP, Azure ATP, Azure Sentinel, and Azure Security CenterSubject matter expert: engaged with director, C-level executives, and technical teams as a trusted advisor leading deep, collaborative connections with customers to provide strategic security consulting.

Reverse engineered malware, exploits, and intrusion tool-sets to discover, enumerate, and remove Advanced Persistent Threats within the Microsoft ecosystemWorked with the Microsoft Threat Intelligent Center's software engineering team to prototype Azure analyticsPerformed log analysis to detect and categorize attacker behavior, tools, and infrastructureProvided reverse engineering support for Microsoft security incidents

Developed, debugged, and analyzed user and kernel mode software on Windows and LinuxDeveloped quick response capabilities for high priority projects that required learning new programming languages, fast paced development and testing life-cycles. Provided high quality documentation of complex systems for non-technical end-usersInitiated conversations with end-users to develop custom solutions to specific capability gapsAuthored and presented technical briefings to division technical directors, senior NSA leadership, military leadership, and other members of the intelligence communityCompleted over five hundred hours of advanced Computer Network Operations training though theNational Cryptologic SchoolTaught C and Python Programming as a Certified Instructor at the National Cryptologic SchoolMalware AnalysisPerformed binary software analysis and signature development for user and kernel mode malicious software in Windows and LinuxPerformed software analysis to identify zero-day software vulnerabilities; persistence, propagations, and privilege escalation methods; bypass obfuscation and packers; and system surveys. Created host and network signaturesCorrelated relationships between families of malware using custom tools and heuristic functional analysisVulnerability ResearchPerformed binary analysis in user and kernel modes on Windows and LinuxPerformed vulnerability analysis to discover security issues in software and hardware platformsResearched and implemented new techniques of interfacing with the Windows kernelDeveloped advanced automation tools for vulnerability discoveryDocumented discovered vulnerabilities and presented host, network based mitigation strategiesIndependently developed multiple advanced Computer Network Operations capabilities

Assisted in the development of laboratory assignments for junior/senior computer science classes and information assurance coursesTeachers assistant for multiple graduate level information assurance and security programming classesManaged the Security Technology Education and Analysis Laboratories (STEAL) for use in information assurance research and teaching

Performed threat analysis for key PNNL information systemsGained experience with Analysts Notebook as well as several in-house information analysis toolsCreated new data-mining and analysis tools in Perl and Python for intrusion detection

Developed real-time network monitoring and defense tools in Python for the intrusion detection group

Designed and implemented custom Java based network operations visualization tool for enhanced administration and monitoring of custom serversExtended visualization library, documented and presented extensions for lab wide adoption

Engineered and lead project to implement Foundry BigIron switches to provide enhanced core network fault toleranceCo-managed corporate roll-out of Cisco VPN solution utilizing CiscosecureAssisted in migration from multiple leased T1 lines to OC-12 and Cisco catalyst 6500 for corporate Internet solutionManaged multiple smaller projects ensuring correct documentation and implementationWorked with Corporate Security Officer to implement security standards for remote dial-in and VPN usersDeveloped, documented and implemented corporate computer software imaging standardsResolved and documented software/hardware/network issues for a nationwide userbaseAssisted team members by acting as technical team lead by researching complex issues and assuring problem resolutionTrained new team members in both technical and policy procedures

Troubleshot Cisco LAN/WAN devices to resolve performance or connectivity issuesCoordinated with telecommunications vendors and ISP's to resolve Internet connectivity issues for 50+ clientsUtilized HP Openview to monitor and troubleshoot connectivity issuesProvided technical service support to both internal and external customersAdministered MS Windows 2000 Active DirectoryDeveloped help desk procedures and standards for documentation Performed problem tracking, resolution, and issue trending to management