SUMMARY

• Network Architect/Engineer/Administrator, Project and Security Manager, Systems and ex - software developer
• Unique background having developed software (see Programming Languages & Tools sidebar on left) Application / Network and Cyber Security and also evolved this to help set up QA departments. This is a full cycle. My philosophy is that I’ve never met a computer language that I could not use.
• IT Security Professional for more than 10 years of hands on experience. Assessing risks, penetration tests of applications and network. Aided law enforcement in the capture of nefarious hackers, served as an expert witness and professional. Hands on experienced with various tools and techniques
• Management Support for Cyber Security, Risk Assessments and Analysis, Systems and Security Policies (SPs), Standard Operating Procedures (SOP) and Statements of Work (SOW).
• Incidence Response Team member for Unisys Stealth technology
• Incidence Response Team member for various Clients and Employers.
• Application Security Professional for various companies and external Entities. Hands on knowledge of various tools, techniques utilizing both SAST and DAST technologies.
• Technical Writer for internal and customer facing documentation including detailed Network Diagrams (using Visio and other tools), Training and Instructional Manuals, Risk Analysis Reports, in depth reporting for SIEM and other aspects, DR/BC review and creation, various other.
• Tools Used: Extensive use of MS Visio, Snaggit, including various COTS and open source tools and techniques.
• Cyber Security Tools used are not limited to: Burp Suite Pro, Qualys, IBM Appscan (DAST Tool), Fortify SCA Professional, NMAP, NESSUS, Aircrack, InSSIDer, Heatmaps for Wireless, SQLmap, Maltego, Wireshark for Packet Analysis, Kali (and others) and various others.
• Current Security+, CISM and CISSP training. Expect Security+ shortly followed by CISM and CISSP. Please note, I have been employed at various companies doing both CISM and CISSP related Cyber Security work for over 10 years. I have had the pleasure of working in the Cyber Security industry for a long time in various roles alongside various people and teams.
• Familiar with NIST, HIPAA, COBIT, PIC-DSS, HITECH, FISMA and various other Federal Standards and Governance.
• IDS/IPS/Log Management talents, including various SIEM tools, log aggregators and techniques.
• Manage projects throughout SDLC, including Patch Management for existing systems and services.
• Consultant and Analyst for needs, design, using creative solutions also to build effective teamwork.
• Strong talents on multiple platforms, interoperability and security.
• 10+ years of hands on Security and Networking experience (lans, wans, switches, routers, firewalls, etc) coupled with Operating System Platforms, Hardware and Software. Utilizing Linux, Windows and other OS’s to meet and exceed project plans.
• Familiar with various routing protocols (RIP, IGRP, OSPF, EGP, BGP, etc), Network Protocols, (VPN, TCP/IP, Token Ring, IPX/SPX, WiFi, etc), Firewalling (Packet Filtering, Stateful Inspection, Application Level, etc.) and Internet Protocols (DNS, DDNS, HTTP, HTTPS, ICMP, FTP, SFTP, SSH, Telnet, etc.)
• Hands on use of multi-flavors of Linux (SME) usage going back to pre-kernel 0.1x. including kernel hacking, modifications, etc.
• Hands on knowledge of Mail servers (Pop, IMAP, SMTP, Web Based), LAMP development on various platforms, advanced Linux Admin and Management techniques including system hardening.
• Hands on use of multi-versions of Windows OS, both desktop, embedded and server.
• Hands on knowledge on industry standards for hardening Windows systems.
• Advanced Troubleshooting techniques including the ability to diagram and document troubleshooting steps (through Logic Trees, Decision Trees, Process Trees, etc.). for knowledge transfer.
• Virtualization Troubleshooting skills for AWS and AZURE Cloud for Linux (RHEL,etc) based instances. This includes VMware 5.5, 6.0, 6.5 with vCenter 5.0.x, 5.5.x, 6.0.x, 6.5.x
• VMware Admin and Architect, maintenance, install, upgrade, troubleshoot, vCenter, thin and thick clients, Capacity Planning, ESXi, Virtual Switches, Networks, repair of VMs, Command Line, etc.
• Architect, installation and Administration of Virtual Environments and Labs using various Virtual technologies including VMware, Linux, Vmware Workstation, Virtual Box, etc.
• Custom designed various firewalls using Linux as well as worked with various FW technologies and vendors.
• Hardware and Software Agnostic

PROFESSIONAL EXPERIENCE

Confidential

Sr Stealth Network/Security Engineer

Responsibilities:

• Interfacing with Client to help ascertain best practices when implementing a Stealth Network. This includes the review of infrastructure, topology and network flows using Unisys tested and approved methodologies.
• Created and Installed a Knowledge base to capture various aspects of day to day interactions with technologies, Engineering, troubleshooting and remediation techniques. Knowledge base can be made into a Troubleshooting Guide for follow on users or engineers.
• Tasked with implementing a way to interact with SharePoint in a way to index all documents and where they reside.
• Managed various Microsoft SharePoint Portals and Informational areas.
• Created tools (scripts) to better ascertain from large data sets information required to create COIs for the Client, within a Stealth Environment.
• Participates in direct client requirements, SOW, POCs, workshops as well as demonstrations and round table discussions. Initiated the need to continue to develop internal workshops through the use of Round Table discussions and demonstrations.
• Support Pre-Sales, Engineering, Sales and senior Management for their Stealth Technologies.
• Forensic research into various events both from a Security perspective as well as software behavioral perspective. Advanced troubleshooting techniques employed.
• Data Center Management of Stealth Appliances and VMs.
• Contributes or initiates technical artifacts through team collaborations and/or Stealth and Security communities of practice.
• Through collaboration with the Client, maintain Stealth Equipment, Monitor same and troubleshoots problems when or if they arise.
• Subject Matter Expert for various versions of Linux (RHEL, Ubuntu, etc) using LAMP, Apache, DNS, Samba, Jenkins, RPM, and various Administration technologies including command line and GUI based.
• Develop various Linux Scripts for clients and internal use.
• Help develop Endpoint Monitoring solutions for Client and internal.
• Troubleshoot and help set up AWS and AZURE Stealth instances for Linux for multiple clients.
• Worked with various Client selected vendors for troubleshooting Stealth in AWS and AZURE Clouds.
• SIEM management using various Log Aggregation packages both commercial and opensource.
• Through the use of Virtualization of servers using various technologies including Linux, VMware, Hyper-V, etc. Set up and maintain Stealth Verification Center on client premise. Lab used as a Verification Center to ensure seamless continuity.
• Tasked with architecting and installing the Malvern Field Labs environment for all Unisys employees to test and verify Stealth capabilities. The Lab is used to verify prior to moving into Client Environment as well as new and existing technologies. Labs were set up to mimic Client site(s). Utilized Active Directory, Netgear and Cisco Switches combined with multiple Dell R920 servers as VMware nodes as well as Cisco ASA firewalls and routers.
• Red Team member and also Tiger Team member for Stealth with Client and internalization requirements.
• Incidence Response Team member for Stealth technology
• Micro-Segmentation utilizing Unisys Stealth technology, which utilizes various forms of Encryption.
• Cyber Security maven pushing Awareness and New techniques and guidelines within networks and applications
• Set up Unisys QA Labs with multimode VMware and well over 1,000 VMs with 2 physical servers introducing 1,500 Linux Containers.
• Developed Test Scripts (automated and manual)
• Bug Tracking
• Signoff processes for bugs and overall progress
• Implemented various software packages to create test cases, bug tracking and remediation.
• All labs are in a “sandbox of sandboxes” with connectivity only through a VPN on internal network.

Confidential

Senior Applications Security Consultant

Responsibilities:

• Application Security using Dynamic (black box) and Static (white box) Analysis techniques
• Mobile Device Management
• Mobile Device Security
• Mobile Device Application Security
• Penetration Tester of Mobile Devices and Mobile and Web based Applications.
• Networking and Systems Consultant
• Risk Management for Mobile and Web Applications
• Client Interaction
• Responsible for Lab operated in a VMWare environment. Lab contained Cisco Switches, Routers and Firewalls.

Confidential, Schenectady NY

Lead Security Consultant focusing on Application Security for various clients.

Responsibilities:

• Help clients develop and define Application Security Incentives.
• Interface with Management including CIO, CISO and other Inter-Agency CIOs and CISOs.
• Create Security Standards for RFP process, including review of bids for security requirements focusing on Application Security and Infrastructure security. For Client, New York State Department of Health
• Create a Standard Risk Assessment spreadsheet that all potential vendors must complete to help identify Security Risks and pinpoint areas where vendors must improve towards Security Standards adopted by the NYSDOH.
• Answered to Security Officer, CISO and ITO. Worked directly with NYSDOH Commissioner on various projects.
• Review, enhance or create where needed various Security Policies and Procedures as related to various aspects of Security for NYSDOH.
• Create a Secure Systems Development Life Cycle plan (SDLC) for NYSDOH
• Train individuals in Application Security, Application Penetration testing using automated and manual tools (AppScan Dynamic Tester, Web Scarab, Burp Suite Pro, and others).
• Audit of Penetration Scans performed to determine vulnerabilities. Create custom reports to be used with AppScan.
• Utilize 3rd party Application penetration tools to validate automated tool findings and use as main validation tools when and as needed coupled with manual Application Penetration techniques.
• Set up Fortify products on clients machines, train users to scan their own code before it is released. Audit of Fortify scans of source code to aid developers.
• Created an internal Application Security Portal for Developers and Management to learn more on how to prevent Vulnerabilities for Applications.
• Monitor and suggest Database Security tools and techniques.
• Create Web log scanning software to look for potential new vulnerabilities being attempted on new and existing Web applications.
• Ran various Pilot Programs for Mobile Device Management (MDM), Cloud Initiatives including Cloud Storage for NYSDOH. These Pilot Programs were at the direct request of the NYSDOH Commissioner and CIO.
• Wireless investigation lead to discover and recommend secure Wireless implementation for NYSDOH (Client) including wireless penetration testing
• Security lead with CISO to work with potential Vendors on various RFPs.
• Work with the NYSDOH CISO to ensure that HIPPA, HITECH and FISMA regulations are applied and adhered to for Vendor related issues as well as in house related questions and issues.
• Act on behalf of NYSDOH CISO for various Security meetings and reviews.
• Cyber Security tasks including IDS, Hacking/Anti-Hacking, forensics, documentation, expert witness,
• Installed Test Lab for Application Security and dissemination of attack software (malware, stealth-ware web based attacks towards various servers and services)
• Interface with Security and Network Staff as required in the review of Network and Application Vulnerabilities. This also included review of IDS and IPS logs from internal and other State agencies.
• Detailed Status reporting on various tasks and functions that were required throughout contracts.
• Responsible for various VMware, VM based environments for testing, application pentesting.
• Contract Sub for HP/Fortify contracts.
• Sr Lead for Sales and Technical questions for Symantec (certified thru 2012) products.
• Multi Month contracts for various clients under Confidential including direct placement from HP Fortify for UBS (International Finance) in New Jersey.

Confidential

Owner, ISO, MIS Director, Senior ConsultantResponsibilities:

• Provide systems, networks, INTRA / INTER and EXTRA-nets and network consulting for clients Nationwide, ranging from Fortune 100 corporations to home-based businesses and individuals. Develop and install various Internet Services.
• Develop and install live system for on-line clients, created with Cold Fusion, PHP, MySQL and MS-SQL Server. System includes Help Desk, On-line Stats, Accounting and various other features.
• DBA for various projects for internal as well as for multiple Clients.
• Design and implement various Networks, utilizing multiple platforms and technologies, wan, lan, vpn and wireless included. Design and implement various Networks for clients, including Network Security, Camera surveillance alarms and alerts (with DVR, NVR, PVR, streaming technologies as well as live to Web photos), Fiber Optic and Copper backbones, etc.
• Develop network architecture utilizing Cisco Routers, Gateways, various firewall equipment, dell and Cisco switches.
• Develop and install Internet and Network Security including Firewalling Technologies. Perform Security sweeps for in house and clientele, including risk assessment. Establish backup and disaster recovery schemes
• Develop and install customized servers and services for clientele and in house projects. including Kernel Tweaking on Linux /Unix platforms. Extensive knowledge of Operating Systems including Linux, Windows and various flavors of Unix.
• Set up a separate Lab for software and network testing in a SET ASIDE Virtual Environment.
• Develop and install various ISPs regionally as well as Nationally.
• E-Commerce utilizing custom designed solutions including POS systems for traditional sales and service., ensuring PCI compliance
• Provide Network installation, troubleshooting, bandwidth monitoring, resource utilization and monitoring. Hands on with various hardware and software solutions.
• Design, install and maintain dedicated telecom lines, Dial-up, fractional to T-1.
• Troubleshoot and repair existing hardware, including systems ordering and integration into existing networks.
• Design Documentation artifacts for various clients.
• Web Hosting, graphics and site design utilizing APACHE, LAMP, PHP, MySql, ODBC, MS Access, Dreamweaver, Photoshop, Flash and various other packages and tools. Web Application Security for clients and in house projects, including manual Penetration Testing.
• Help various clients with Application Security issues, training, setting goals and establishment of various protocols and SDLC.
• Perform network and Application evaluations for in house and clientele. This included Penetration tests as well as known hacking techniques.
• Penetration tests for Clients as needed.
• Help develop Security protocols for various clients of various sizes.

Confidential

Senior Programmer/Analyst/Staff Trainer, Network Manager/Administrator

Responsibilities:

• An Authorized training center for Confidential, Confidential, Confidential
• Network Manager for Internal Network as well as for Client Networks, including dial up access, remote access and remote networking computing using Cisco and other manufacturers equipment.
• Project Management of R&D, Systems Design and implementation and network consulting for clients as well as in house projects, Object Oriented Design (OOD) and programming.
• Training of End Users, Technical Manuals and documentation in CA-Clipper and other in house Data Driven Applications.
• Electronic Data Interchange (EDI) liaison and Programmer/Designer for clients engaged in interstate and international commerce.