Feb 2025 – Present · 1 yr 2 mos

• Leads cybersecurity engineers who build, enhance, and maintain complex software systems for the US Intelligence Community.
• Provides oversight of team work assignments through ServiceNow ticketing system.
• Serves as a technical lead and point of escalation on architecture, system function, and other tasking for a team of 15-20 engineers
• Ensures staff development and training
• Collaborates with senior leadership and other engineering discipline leads.
• Identifies and oversees the discovery and implementation of process improvements.
• Interfaces directly with customers and briefs at program reviews as the CDA representative
• Monitors progress across programs and collaborates with program managers to track schedules and ensure successful completion
• Contributes to new business development and proposals as a subject matter expert, conceptualizing technical solutions and providing detailed estimates of resources and schedule
• Provides active leadership and encourages team collaboration, fosters operational improvement, and provides constructive feedback. Creates a great team and leads from the front.
• Schedules team members to cover the 5-days a week, 16hrs a day, with 2hr recall for multiple technologies, emergencies authorized outages, and break fix incidents.

Oct 2023 – Apr 2025 · 1 yr 6 mos

• Leads Engineers on related taskings to maintain timelines for project objectives
• Analyzes trends and patterns of data on networks to identify and predict previously undiscovered events and incidents, and develop or tune rules/signatures/scripts as needed
• Coordinates with other Cybersecurity Operations to develop or tune rules/signatures/scripts
• Coordinates with other Cybersecurity Operations Services to investigate and obtain information about potential sources of compromise on systems, and develop or tune rules/signatures/scripts as needed
• Correlates and analyzes precursors to incidents, and develop or tune rules/signatures/scripts as needed
• Improve SIEM alert efficiency though evaluation of valid alerts and false positives, and develop or tune rules/signatures/scripts as needed
• Assists the Cyber Incident Response Team by assessing ongoing incident activity to predict adversary responses and locations of compromise

Mar 2023 – Oct 2023 · 7 mos

• Coordinate and implement tasks, performing analysis, and building/documenting response activities required during cyber security incident response, to include but not limited to actions such as implementing containment measures, IP blocks, domain blocks, and disabling user accounts on direction of the Government
• Coordinates with Security and Installations Directorate (SI) Office of Counterintelligence (SIC), Insider Threat Office (SIII), in addition to other law enforcement and counter intelligence personnel as required to perform advanced investigation and triage of incidents
• Coordinates with other contracts, organizations, activities, and other services as appropriate to ensure incidents are properly reported, contained, and eradicated
• Coordinates with other contracts, organizations, activities, and services to ensure enterprise recovers from an incident/event
• Builds timelines, documents, briefings, and other products as required to inform stakeholders of incident response actions, analysis, and the impact of both adversary activity and blue force response actions.
• Develops, maintains, sustains, and when properly authorized by the Government executes custom scripts, tools, and capabilities to collect and analyze data, and to respond to incidents/events
• Develops and identifies indicators of compromise to send to Cybersecurity stakeholders and other Contract Services
• Provides adversary attribution
• Performs malware analysis and signature development
• Performs digital media analysis and malware reverse engineering on host, server, and network data as required to analyze and respond to an incident, to include but not limited to volatile and non-volatile memory and/or system artifact collection and analysis.
• Conduct Quality Control reviews of a percentage closed CSOC Tier 2 tickets each week to ensure proper analysis, categorization, documentation, and notification

May 2022 – Mar 2023 · 10 mos

• Analyzes trends and patterns of data on networks to identify and predict previously undiscovered events and incidents, and develop or tune rules/signatures/scripts as needed
• Coordinates with other Cybersecurity Operations to develop or tune rules/signatures/scripts
• Coordinates with other Cybersecurity Operations Services to investigate and obtain information about potential sources of compromise on systems, and develop or tune rules/signatures/scripts as needed
• Correlates and analyzes precursors to incidents, and develop or tune rules/signatures/scripts as needed
• Improve SIEM alert efficiency though evaluation of valid alerts and false positives, and develop or tune rules/signatures/scripts as needed
• Assists the Cyber Incident Response Team by assessing ongoing incident activity to predict adversary responses and locations of compromise

Jun 2020 – May 2022 · 1 yr 11 mos

• Triage alerts to identify malicious actors on customer networks
• Complete moderate-level cyber analysis of potential events
• Assist Tier 1 analysts with training and assistance when needed to comprehend an exploit better when it is a common occurrence
• Review DOS monitoring dashboard to recommend blocks on high traffic actors that are malicious.
• Assist with exercises implemented by offensive team, or when an advanced actor shows a compromise within the network.