Home

Ibrahim mohd saleem - Cybersecurity Engineer

[email protected]

Location: Aurora, Illinois, USA

Relocation: Yes

Visa: GC EAD

Resume file: Ibrahim-Saleem-Cybersecurity-Resume-KK Master (1)_1791486198413.docx Please check the file(s) for viruses. Files are checked manually and then made available for download.

Professional Summary PROFESSIONAL SUMMARY Accomplished Senior Cybersecurity Engineer and SOC Architect with 9 plus years of experience designing, implementing, and operationalizing enterprise-grade security operations, SIEM platforms, threat detection, incident response, network security, cloud security, vulnerability management, DLP, and GRC programs across financial services, healthcare, government, and retail sectors. Expert SIEM architect with hands-on production experience across Splunk Enterprise, IBM QRadar, ArcSight ESM, LogRhythm, Trellix SIEM (formerly McAfee Nitro), Microsoft Sentinel, Elastic SIEM, Google Chronicle, FortiSIEM, and NetWitness, designing custom correlation rules, detection logic, dashboards, and automated response workflows reducing MTTD and MTTR across enterprise environments. Comprehensive threat detection and incident response expertise using Palo Alto Cortex XSOAR, SentinelOne Singularity XDR, CrowdStrike Falcon EDR, Microsoft Defender for Endpoint XDR, Palo Alto Cortex XDR, Carbon Black, FireEye, and SOAR platforms for automated threat containment, digital forensics, malware analysis, and coordinated CSIRT operations across regulated environments. Deep cloud security and CSPM expertise using Wiz CNAPP and DSPM, Prisma Cloud CSPM, Microsoft Defender for Cloud, Microsoft Purview, Varonis Data Security Platform, Azure Monitor, AWS Security Hub, Amazon GuardDuty, Zero Trust architecture, ITDR, and UEBA protecting multi-cloud environments across Azure Office 365 and AWS. Extensive identity and access management integration using Okta SSO and MFA, Azure Active Directory Entra ID, Microsoft Entra ID Protection, CyberArk PAM, HashiCorp Vault, RSA SecurID, CrowdStrike Falcon Identity Protection, and Privileged Identity Management PIM strengthening identity governance and privileged access controls across enterprise financial healthcare and government environments. Expert GRC practitioner implementing ISO 27001, NIST SP 800-53, NIST CSF 2.0, FISMA, DISA STIG, RMF, ATO, HIPAA, PCI-DSS, SOX, ITGC, COBIT, FFIEC, GLBA, DORA, NIS2, and OWASP controls with hands-on SSP documentation, risk assessments, and audit support across four distinct regulated industry sectors. Strong vulnerability management using Qualys VMDR, Tenable One Exposure Management, Tenable Nessus, Rapid7 Nexpose InsightVM, Microsoft Defender Vulnerability Management, CrowdStrike Falcon Spotlight, NMAP, Metasploit, and EPSS Exploit Prediction Scoring delivering risk-based remediation programs across enterprise environments. Deep network security and firewall architecture expertise across Palo Alto NGFW, Check Point, Fortinet FortiGate, Cisco ASA, Juniper SRX, F5 BIG-IP LTM and GTM, Imperva WAF, Radware AppWall, Broadcom Proxy SG, Forcepoint, Snort IDS/IPS, and Cisco Secure IPS/Firepower governing enterprise perimeter and DMZ security. Proven NDR and threat intelligence capabilities using ExtraHop Reveal(x), Darktrace AI-powered NDR, Vectra AI, Cisco Secure Network Analytics, Recorded Future, Microsoft Defender Threat Intelligence, VirusTotal Enterprise, Shodan, MITRE ATT&CK framework, and NetWitness alongside proactive threat hunting to identify APTs and insider threats. At Voya Financial architected enterprise security operations integrating Microsoft Sentinel, CrowdStrike Falcon, Wiz CNAPP, Palo Alto XSOAR, Microsoft Purview, Varonis, Recorded Future, ExtraHop NDR, Darktrace, Vectra AI, Tenable One, and ServiceNow GRC across Azure and AWS while leading PCI-DSS SOX ITGC COBIT FFIEC GLBA compliance programs and CSIRT operations. Proven ability to lead cross-functional cybersecurity programs, manage SOC teams, mentor security analysts, design enterprise security architectures, and deliver measurable security posture improvements across complex multi-sector regulated enterprise environments. TECHNICAL SKILLSET SIEM and Security Analytics Splunk Enterprise, IBM QRadar, ArcSight ESM (OpenText), LogRhythm, Trellix SIEM (formerly McAfee Nitro), Microsoft Sentinel, Elastic Security SIEM, Google Chronicle SIEM, FortiSIEM (formerly AccelOps), NetWitness (formerly RSA Security Analytics), NetForensics, HP ArcSight, SPL, QRadar AQL, KQL, YARA-L, UDM, ESCU, Splunk UEBA, correlation rule development, custom dashboards, alert tuning, log source integration, threat use case design, threat hunting queries. SOAR and Automation Palo Alto Cortex XSOAR, Microsoft Sentinel SOAR (Logic Apps), Splunk SOAR (formerly Phantom), ServiceNow Security Operations SecOps, playbook development, automated incident response, alert triage automation, threat enrichment workflows, SOAR-SIEM-EDR integration, Python automation scripts, API-driven security orchestration, runbook automation, false positive reduction, SOC efficiency automation. Endpoint Security and EDR CrowdStrike Falcon EDR, SentinelOne Singularity XDR, Microsoft Defender for Endpoint, Microsoft Defender XDR, Palo Alto Cortex XDR, Carbon Black (VMware), Trellix ePolicy Orchestrator (formerly McAfee ePO), Symantec Endpoint Protection SEPM, HBSS, HIPS, Tanium, FireEye, Trellix Rogue System Detection, Velociraptor DFIR, malware analysis, behavioral threat detection, EDR-SIEM integration. Network Security and Firewalls Palo Alto Networks NGFW, Check Point Firewall (Power-1 UTM-1 Smart-1), Fortinet FortiGate, Cisco ASA, Juniper SRX, F5 BIG-IP LTM and GTM, Imperva WAF, Radware AppWall WAF, Broadcom Proxy SG (formerly Blue Coat), Forcepoint Web Security (formerly Websense), Snort IDS/IPS, Cisco Secure IPS/Firepower (formerly Sourcefire), IBM Network IPS, Tufin Firewall Monitoring, VPN, NAT, ACL management, DMZ architecture, firewall rule analysis. Network Detection and Response ExtraHop Reveal(x) NDR, Darktrace AI-powered NDR, Vectra AI network detection and response, Cisco Secure Network Analytics (formerly Stealthwatch), Corelight network security monitoring, network flow analysis, east-west traffic analysis, encrypted threat detection, AI-driven behavioral anomaly detection, lateral movement detection, C2 communication identification, network forensics, NDR-SIEM integration. Cloud Security and CSPM Wiz CNAPP and DSPM, Prisma Cloud CSPM, Microsoft Defender for Cloud, Microsoft Purview DSPM, Varonis Data Security Platform, Orca Security CSPM, Lacework CNAPP, Tenable Cloud Security, Microsoft Defender for Cloud Apps CASB, Azure Monitor, Azure Security Center, AWS Security Hub, Amazon GuardDuty, AWS CloudWatch, AWS CloudTrail, AWS IAM, Azure Active Directory Entra ID, Microsoft Entra ID Protection, Office 365 Security, Zero Trust architecture, ITDR, UEBA, multi-cloud security posture management. Identity and Access Management Okta SSO and Adaptive MFA, Azure Active Directory Entra ID, Microsoft Entra ID Protection, CrowdStrike Falcon Identity Protection, SentinelOne Singularity Identity (formerly Attivo), RSA SecurID, CyberArk PAM, HashiCorp Vault secrets management, Privileged Identity Management PIM, Azure MFA, Active Directory LDAP, LAPS Local Administrator Password Solution, RBAC, privileged access governance, identity lifecycle management, SSO, Zero Trust identity principles, ITDR. Vulnerability Management and Pen Testing Qualys VMDR, Tenable One Exposure Management, Tenable Nessus, Rapid7 Nexpose InsightVM, Microsoft Defender Vulnerability Management, CrowdStrike Falcon Spotlight, NMAP, Metasploit, IBM AppScan, Wireshark, EPSS Exploit Prediction Scoring System, Attack Surface Management ASM, vulnerability scanning, penetration testing, OWASP Top 10, CVE/CVSS risk-based prioritization, remediation SLA tracking, PCI-DSS compliance scanning, web application security testing. Data Loss Prevention Symantec DLP (Endpoint Prevent, Network Prevent for Email, Network Prevent for Web, Network Discover, ICA), Trellix DLP (formerly McAfee DLP), Forcepoint DLP (formerly Websense DLP), Microsoft Purview Information Protection, Varonis Data Security Platform, Proofpoint Email Protection, Proofpoint ATP, Cofense phishing defense, Microsoft Defender for Cloud Apps CASB, policy tuning, false positive reduction, DLP incident investigation, sensitive data classification, insider threat monitoring, data access governance. Threat Intelligence and Detection STIX, TAXII, Splunk Threat Intelligence (formerly TruSTAR), Recorded Future, Microsoft Defender Threat Intelligence MDTI, VirusTotal Enterprise, Any.run sandbox analysis, Joe Sandbox malware analysis, Shodan, Censys attack surface intelligence, MITRE ATT&CK framework and Navigator, Cyber Threat Intelligence CTI, UEBA, NetWitness, threat hunting, IOC management, adversary profiling, phishing analysis, malware investigation, digital forensics, Proofpoint TAP, Cofense Intelligence, kill chain analysis. GRC and Compliance NIST SP 800-53, NIST CSF 2.0, FISMA, DISA STIG, RMF, ATO, System Security Plans SSP, ISO 27001, ISO 27002, PCI-DSS, SOX, HIPAA, HITECH, ITGC, COBIT, FFIEC, GLBA, OWASP, Privacy Act, DORA Digital Operational Resilience Act, NIS2 Directive, SEC Cybersecurity Disclosure Rules, EPSS, C and A, risk assessments, gap analysis, vendor risk management, ServiceNow GRC, Archer GRC, OneTrust GRC, security audit support, compliance documentation. Incident Response and Forensics CSIRT operations, incident investigation, containment eradication and recovery, digital forensics, malware analysis, threat analysis, Cyber Kill Chain, MITRE ATT&CK TTP mapping, incident escalation, forensic evidence collection, Velociraptor DFIR, DR, BCP, root cause analysis, incident reporting, SolarWinds monitoring, post-incident review, regulatory breach notification assessment. Networking and Infrastructure Cisco Routers and Switches, VLANs, STP RSTP MST, VTP, EtherChannel LACP PAgP, Port Security, BPDU Guard, TCP/IP, SSL/TLS, VPN, BGP, DNS, NAT, Aruba Wireless, Network TAPs, SPAN Ports, LAN/WAN, Wireshark packet capture, network architecture design, Microsoft Visio, Broadcom Proxy SG, Forcepoint Web Security, Cisco Secure IPS/Firepower. OS Virtualization and Scripting Windows Server 2008/2012/2016/2022, Windows 7/10/11, Red Hat Enterprise Linux RHEL, CentOS, UNIX, VMware vSphere, VMware vCenter, system hardening, patch management, configuration management, Red Hat Satellite, SCCM, Ivanti (formerly LANDesk/Altiris), HCL BigFix, Python, Java/J2EE, PHP, HTML, Bash, PowerShell, SQL, Git/GitHub, security automation scripting, SOAR playbook scripting. Collaboration and ITSM ServiceNow, ServiceNow GRC, ServiceNow Security Operations, Jira, Confluence, Microsoft Teams, Slack, SharePoint, PagerDuty, OpsGenie, ticketing and change management, security documentation, runbook authoring, technical diagram creation Microsoft Visio, audit evidence collection, executive security reporting. WORK EXPERIENCE Voya Financial New York, NY | Jan 2024 to Present Senior Cyber Security Engineer Architected enterprise SIEM platform transformation integrating Microsoft Sentinel as primary cloud-native SIEM alongside Splunk Enterprise, IBM QRadar, ArcSight ESM, Trellix SIEM (formerly McAfee Nitro), and LogRhythm, designing custom KQL and SPL detection rules, correlation logic, and automated alert workflows covering FFIEC GLBA and SOX financial services threat scenarios. Designed and deployed Palo Alto Cortex XSOAR SOAR platform with automated playbooks for phishing investigation, credential compromise, malware containment, and cloud security alert triage, integrating XSOAR with Splunk, Microsoft Sentinel, CrowdStrike Falcon, Qualys, and ServiceNow to automate full incident lifecycle management and reduce analyst workload. Deployed CrowdStrike Falcon EDR and SentinelOne Singularity XDR across enterprise endpoints configuring behavioral detection policies, threat hunting queries, automated quarantine workflows, and Falcon X threat intelligence integration delivering AI-powered endpoint protection against advanced persistent threats and fileless malware campaigns targeting financial services. Led cloud security program deploying Wiz CNAPP and DSPM for agentless cloud posture management, Prisma Cloud CSPM for multi-cloud governance, Microsoft Defender for Cloud for workload protection, and AWS Security Hub and GuardDuty for centralized threat detection across Azure and AWS banking environments. Implemented Zero Trust architecture using Okta adaptive SSO and MFA, Azure Active Directory Entra ID Conditional Access, CyberArk PAM for critical financial systems, HashiCorp Vault for dynamic secrets management, ITDR identity threat detection, and UEBA behavioral analytics to detect account compromise and insider threats. Conducted PCI-DSS, SOX, ITGC, COBIT, FFIEC, GLBA, and NIST compliance assessments, developed remediation plans, maintained System Security Plans and governance documentation, supported internal and external audit engagements, and delivered executive-level security risk reporting covering enterprise cybersecurity posture and control deficiencies. Performed vendor risk assessments, third-party cybersecurity reviews, and vendor risk scorecards evaluating security posture of fintech partners, cloud service providers, and critical technology vendors implementing enterprise vendor risk management framework following OCC guidance and NIST SP 800-53 third-party risk controls. Administered enterprise DLP program including Symantec DLP Endpoint Prevent Network Prevent and Network Discover alongside Microsoft Purview Information Protection and Microsoft Defender for Cloud Apps, configuring financial data classification policies, incident investigation workflows, and executive DLP reporting to protect customer financial data. Managed vulnerability lifecycle using Qualys VMDR and Tenable One Exposure Management across enterprise infrastructure, performing CVE and CVSS risk-based prioritization with EPSS scoring, coordinating remediation SLA enforcement, managing penetration testing engagements, and maintaining PCI-DSS quarterly scanning compliance for cardholder data environments. Deployed Microsoft Defender XDR unified platform integrating Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, and Microsoft Sentinel for unified extended detection and response visibility across endpoints identity cloud applications and email security telemetry at Voya Financial. Implemented Microsoft Purview compliance and data governance platform for sensitive financial data classification, DLP policy enforcement, insider risk management, communication compliance monitoring, and eDiscovery supporting SOX PCI-DSS and SEC cybersecurity disclosure requirements across Voya Financial. Deployed Varonis Data Security Platform for data access governance, sensitive data discovery, and abnormal access behavior detection across file shares SharePoint and cloud storage, identifying overexposed financial data, enforcing least privilege access, and generating audit evidence for PCI-DSS SOX and GLBA compliance programs. Integrated Recorded Future threat intelligence platform and Microsoft Defender Threat Intelligence MDTI with Microsoft Sentinel and Splunk SIEM for automated IOC enrichment, adversary tracking, and proactive threat intelligence operationalization reducing analyst investigation time for financial sector threat actors. Deployed ExtraHop Reveal(x) NDR, Darktrace AI-powered NDR, and Vectra AI network detection platforms for east-west traffic analysis, encrypted threat detection, AI-driven behavioral anomaly detection, and insider threat identification across Voya Financial internal network segments and cloud environments. Administered Cisco Secure Network Analytics and VirusTotal Enterprise for network flow analysis, anomaly detection, lateral movement identification, and malware analysis across financial services network infrastructure, correlating network telemetry with Microsoft Sentinel SIEM and CrowdStrike Falcon EDR for unified threat detection. Configured and maintained Palo Alto NGFW, Check Point, and Fortinet FortiGate firewalls protecting banking applications and DMZ environments, administered F5 BIG-IP LTM and GTM load balancers, and managed IDS/IPS policies detecting network-based attacks and lateral movement across financial services infrastructure. Managed ServiceNow GRC and Security Operations platform for risk register management, policy exception workflows, vendor risk assessment automation, security incident management, and audit evidence collection supporting SOX ITGC COBIT FFIEC and GLBA governance requirements across Voya Financial. Automated security operations using Python and API integrations between SIEM SOAR EDR and vulnerability management platforms, developing Splunk custom apps, Microsoft Sentinel workbooks, and XSOAR playbooks reducing incident response time and eliminating manual repetitive analyst tasks across SOC operations. Environment: Microsoft Sentinel, Splunk Enterprise, IBM QRadar, ArcSight ESM, Trellix SIEM, LogRhythm, Elastic SIEM, Google Chronicle, Palo Alto Cortex XSOAR, CrowdStrike Falcon EDR, SentinelOne Singularity XDR, Microsoft Defender for Endpoint, Microsoft Defender XDR, Palo Alto Cortex XDR, Wiz CNAPP/DSPM, Prisma Cloud CSPM, Microsoft Defender for Cloud, Microsoft Purview, Varonis Data Security Platform, Recorded Future, Microsoft Defender TI, VirusTotal Enterprise, ExtraHop Reveal(x) NDR, Darktrace NDR, Vectra AI NDR, Cisco Secure Network Analytics, ServiceNow GRC, Azure Monitor, AWS Security Hub, Amazon GuardDuty, AWS CloudTrail, Okta SSO/MFA, Azure Active Directory/Entra ID, Microsoft Entra ID Protection, CyberArk PAM, HashiCorp Vault, RSA SecurID, ITDR, UEBA, XDR, Zero Trust, Qualys VMDR, Tenable One, Tenable Nessus, EPSS, Palo Alto NGFW, Check Point, Fortinet FortiGate, F5 BIG-IP LTM/GTM, Symantec DLP, Forcepoint DLP, Proofpoint, AWS (EC2, S3, IAM, Lambda, CloudFront), Azure, Office 365, MITRE ATT&CK, Python, PCI-DSS, SOX, ITGC, COBIT, FFIEC, GLBA, NIST SP 800-53 Nanthealth Winterville, NC | Nov 2021 to Nov 2023 Cyber Security Engineer Administered Symantec DLP platform including Endpoint Prevent, Network Prevent for Email, Network Prevent for Web, Network Discover, and Information Centric Analytics protecting PHI and PCI cardholder data, configuring detection policies to reduce false positives, investigate violations, and maintain HIPAA PCI-DSS and SOX compliance requirements. Deployed Microsoft Sentinel as primary SIEM integrating Azure Monitor, Office 365, Defender for Endpoint, and network platforms, developing KQL analytics rules for HIPAA-relevant threat scenarios, PHI exfiltration detection, and user access anomaly identification across HIPAA-regulated healthcare environments. Implemented CrowdStrike Falcon EDR and Microsoft Defender for Endpoint across healthcare endpoints configuring behavioral detection policies and threat hunting queries targeting healthcare-specific ransomware, malware campaigns, and lateral movement affecting clinical systems and patient data repositories. Designed multi-SIEM analytics environment integrating Splunk, IBM QRadar, ArcSight ESM, Trellix SIEM, and LogRhythm, developing custom correlation rules, detection use cases, and dashboards targeting HIPAA healthcare threat scenarios, PHI access monitoring, and insider threat detection for clinical application environments. Deployed Prisma Cloud CSPM and Microsoft Defender for Cloud across Azure and AWS providing healthcare cloud posture assessment, HIPAA and NIST compliance monitoring, containerized workload protection, and cloud-native threat detection integrated with Microsoft Sentinel SIEM. Implemented Okta SSO adaptive MFA and Azure Active Directory Conditional Access for healthcare application governance, integrated CyberArk PAM for clinical systems privileged access, deployed HashiCorp Vault for secrets management, and enforced Zero Trust access principles across HIPAA-regulated Nanthealth environments. Investigated phishing campaigns and malicious emails using Proofpoint Email Protection, Proofpoint ATP, and Cofense phishing intelligence, implementing blocking, remediation, and user awareness measures protecting Nanthealth clinical staff from email-based threats targeting healthcare organizations. Deployed Microsoft Purview Information Protection for PHI classification, sensitivity labeling, and DLP policy enforcement across Office 365 SharePoint and Teams environments, ensuring HIPAA-compliant data handling and preventing unauthorized PHI disclosure across Nanthealth clinical collaboration platforms. Implemented Varonis Data Security Platform for PHI access governance and insider threat detection across clinical file shares and healthcare application data repositories, identifying excessive PHI access, enforcing least privilege, and generating HIPAA compliance audit evidence for access control requirements. Integrated Recorded Future and VirusTotal Enterprise threat intelligence with Microsoft Sentinel SIEM for automated IOC enrichment and malware analysis, accelerating healthcare threat investigation by correlating indicators with known ransomware campaigns and healthcare sector threat actors targeting clinical environments. Deployed ExtraHop Reveal(x) NDR for encrypted network traffic analysis and behavioral anomaly detection across Nanthealth clinical network segments, identifying lateral movement, command and control communications, and anomalous EHR system access patterns in HIPAA-regulated environments. Administered Tenable One Exposure Management and Microsoft Defender Vulnerability Management for unified clinical asset exposure assessment, correlating vulnerability findings with threat intelligence to prioritize remediation of critical healthcare system vulnerabilities using EPSS exploit prediction scoring. Performed continuous monitoring of IDS/IPS, Check Point Firewall, Snort, and FortiSIEM detecting, investigating, and remediating security incidents and network intrusions, conducting MITRE ATT&CK-based threat hunting to identify advanced persistent threats targeting healthcare data. Performed digital forensics and malware analysis for healthcare security incidents, conducting root cause analysis, coordinating eradication and recovery, and preparing incident reports for executive leadership and compliance teams supporting HIPAA breach notification assessment. Developed security policies, risk assessments, and RMF documentation per NIST SP 800-53 supporting HIPAA implementation, conducted UEBA to detect anomalous PHI access patterns, and collaborated with compliance teams on healthcare regulatory governance requirements. Automated security operations using Python scripting and SOAR capabilities developing Splunk alerts, QRadar custom properties, and Sentinel analytics rules reducing investigation time and improving SOC analyst efficiency protecting clinical infrastructure and patient data. Environment: Microsoft Sentinel, Splunk Enterprise, IBM QRadar, ArcSight ESM, Trellix SIEM, LogRhythm, FortiSIEM, Symantec DLP (Endpoint Prevent, Network Prevent, Network Discover, ICA), Forcepoint DLP, Proofpoint Email Protection, Proofpoint ATP, Cofense, CrowdStrike Falcon EDR, Microsoft Defender for Endpoint, Microsoft Defender XDR, Symantec Endpoint Protection SEPM, Carbon Black, Prisma Cloud CSPM, Microsoft Defender for Cloud, Microsoft Purview, Varonis Data Security Platform, Recorded Future, VirusTotal Enterprise, ExtraHop Reveal(x) NDR, Tenable One, Microsoft Defender Vulnerability Management, EPSS, Azure Monitor, Office 365, AWS (Security Hub, GuardDuty, EC2, S3, IAM), Okta SSO/MFA, Azure Active Directory/Entra ID, CyberArk PAM, HashiCorp Vault, Check Point Firewall, Snort IDS/IPS, Tenable Nessus, Qualys, UEBA, Zero Trust, MITRE ATT&CK, Python, HIPAA, PCI-DSS, SOX, NIST SP 800-53, RMF State of New York New York, NY | Apr 2020 to Aug 2021 Cyber Security Engineer Deployed Microsoft Sentinel alongside NetWitness (formerly RSA Security Analytics) for government SIEM operations, configuring data connectors, KQL detection rules, government threat use cases, and SOAR automation playbooks supporting New York State security operations and FISMA continuous monitoring requirements. Managed NetWitness platform supporting security event monitoring, threat analysis, incident investigation, and data source integration across State government infrastructure, developing correlation rules and dashboards following NIST continuous monitoring standards. Supported IBM Network IPS and Cisco ASA Firewall administration configuring security policies, monitoring intrusion attempts, troubleshooting false positives, and investigating network-based attacks across State government infrastructure using network TAPs and SPAN ports for traffic visibility. Implemented Tenable Nessus vulnerability scanning program across State government infrastructure, performing authenticated scans, coordinating remediation with agency IT teams, tracking FISMA POA&M, and supporting continuous monitoring reporting for state government security compliance. Configured Okta SSO and Azure Active Directory for State government application access governance, implementing MFA enforcement and Conditional Access policies following NIST SP 800-63 digital identity guidelines and government Zero Trust architecture requirements. Performed network security troubleshooting and traffic analysis using Wireshark, Cisco ASA, network TAPs, and SPAN ports validating connectivity, monitoring traffic flows, investigating security incidents, and collecting forensic evidence for government cybersecurity investigations. Installed and maintained enterprise infrastructure including Windows Server 2008/2012, Red Hat Enterprise Linux RHEL, VMware vSphere 5.5/6, and vCenter supporting cybersecurity platform deployments and DISA STIG hardening requirements across State government environments. Administered SolarWinds infrastructure monitoring for cybersecurity platform health and availability, integrating alerts with security operations workflows, configuring dashboards for platform visibility, and maintaining critical State government cybersecurity monitoring infrastructure. Executed FISMA continuous monitoring program implementing security controls, managing POA&Ms, collecting control assessment evidence, maintaining System Security Plans SSP, and supporting ATO processes per NIST RMF framework for State government information systems. Coordinated with network teams, security engineers, and infrastructure groups ensuring successful installation, configuration, integration, and operational readiness of cybersecurity monitoring platforms across New York State agency environments. Created comprehensive technical documentation including installation guides, configuration standards, troubleshooting procedures, and architecture diagrams in Microsoft Visio for security tools supporting knowledge transfer, operational continuity, and FISMA documentation requirements. Researched and evaluated emerging cybersecurity technologies and industry best practices recommending solutions matching State security requirements, evaluating SIEM EDR and SOAR platforms for government use, and supporting technology acquisition decisions through proof-of-concept testing. Environment: Microsoft Sentinel, NetWitness (formerly RSA Security Analytics), IBM Network IPS, Cisco ASA Firewall, Network TAPs, SPAN Ports, Tenable Nessus, SolarWinds, Okta SSO/MFA, Azure Active Directory, Wireshark, Windows Server 2008/2012, Red Hat Enterprise Linux RHEL, VMware vSphere 5.5/6, VMware vCenter, Active Directory, DNS, TCP/IP, NIST SP 800-53, FISMA, DISA STIG, RMF, ATO, SSP, POA&M Publix SuperMarkets Florida | Oct 2018 to Feb 2020 Cyber Security Analyst Managed enterprise SIEM operations using Splunk, ArcSight ESM, NetForensics, Trellix SIEM (formerly McAfee Nitro), and IBM QRadar analyzing security events, investigating alerts, performing log correlation, and supporting incident response protecting critical retail business systems and customer payment data across PCI-DSS cardholder environments. Implemented and maintained PCI-DSS, SOX, HIPAA/HITECH, Privacy Act, and ISO 27001 security controls across retail environments, supporting compliance audits, preparing risk assessments and System Security Plans, maintaining compliance evidence, and coordinating remediation of audit findings. Deployed and maintained Splunk Enterprise security infrastructure including clustered highly available deployments, administering content management, upgrades, patching, and lifecycle processes, developing custom SPL detection rules and dashboards for retail threat monitoring and PCI-DSS compliance reporting. Administered Symantec Endpoint Protection, Carbon Black EDR, and Trellix ePO (formerly McAfee ePO) across retail infrastructure performing malware analysis, threat investigation, endpoint incident response, and security event correlation with SIEM protecting retail store systems and point-of-sale environments. Conducted vulnerability assessments and penetration testing using Nessus, Rapid7 Nexpose InsightVM, Qualys, NMAP, Metasploit, and IBM AppScan identifying security weaknesses across retail infrastructure and web applications and coordinating remediation with infrastructure teams. Administered Symantec DLP and Proofpoint Email Protection, performing daily DLP monitoring, incident analysis, policy validation, and remediation protecting sensitive customer payment information per PCI-DSS cardholder data protection requirements. Managed Microsoft Azure, Office 365, and AWS cloud security including Azure Security Center monitoring, AWS IAM configuration, VPN connectivity, Direct Connect, and cloud compliance reviews ensuring retail cloud environments met PCI-DSS and SOX requirements. Configured and maintained Cisco ASA, Palo Alto, and Juniper SRX firewalls protecting retail infrastructure and point-of-sale network segments, implementing PCI-DSS network segmentation controls, performing firewall rule analysis using Tufin, and managing IDS/IPS policies. Performed security incident investigation, threat analysis, malware analysis, and remediation by analyzing alerts from Splunk SIEM, DLP, endpoint security, firewall, and network monitoring platforms, coordinating incident response with retail operations teams per PCI-DSS requirements. Collaborated with network application infrastructure and business teams to implement security standards, improve security posture, conduct security architecture reviews for retail technology deployments, and mentor junior security analysts on SIEM operations and incident response procedures. Developed and maintained GRC processes including vendor risk assessments, security policies, System Security Plans, Risk Assessments, Security Assessment Reports, and audit documentation supporting PCI-DSS SOX HIPAA and ISO 27001 compliance programs across Publix retail operations. Environment: Splunk Enterprise, IBM QRadar, ArcSight ESM, NetForensics, Trellix SIEM (formerly McAfee Nitro), Carbon Black, Symantec Endpoint Protection, Trellix ePO (formerly McAfee ePO), Forcepoint, Symantec DLP, Proofpoint, Qualys, Nessus, Rapid7 Nexpose, InsightVM, NMAP, Metasploit, IBM AppScan, Cisco ASA, Palo Alto Firewall, Juniper SRX, Tufin, Broadcom Proxy SG (formerly Blue Coat), IDS/IPS, Microsoft Azure, Azure Security Center, Office 365, AWS (IAM, EC2, S3, Direct Connect, CloudWatch), VPN, PCI-DSS, SOX, HIPAA/HITECH, ISO 27001 ITC Infotech Bangalore, India | Apr 2017 to Jun 2018 Security Engineer Administered enterprise network security infrastructure including Check Point Power-1 UTM-1 Smart-1 and Cisco ASA firewalls, Cisco IPS, and Radware AppWall WAF, implementing firewall policies, VPN configurations, and ISO 27001 PCI-DSS SOX security controls while performing risk assessments and auditing firewall policies using Tufin monitoring. Managed Cisco router and switch infrastructure, designed Broadcom Proxy SG (formerly Blue Coat) and Forcepoint Web Security (formerly Websense) web security implementation, developed NIST-based cybersecurity standards, configured LAN/WAN networking, and maintained Disaster Recovery Data Center security configuration meeting customer compliance requirements. Configured and monitored enterprise security systems identifying key security risks, reporting risks to management with recommendations following NIST SP 800-53 and ISO 27001 frameworks, performed LAN/WAN implementation analysis optimization and troubleshooting supporting customer enterprise network and security operations. Performed ISO 27001 PCI-DSS and SOX security audits driving closure of audit findings, developed cybersecurity standards based on NIST frameworks ensuring proper implementation reducing vulnerability risk to IT assets, and configured compliance rules extracting security risks auditing firewall policies using Tufin. Supported disaster recovery data center security configuration and management, configured remote vendor equipment at various customer sites, implemented Aruba wireless infrastructure for secure multi-SSID deployment, and reviewed encryption logs and DLP logs to regulate technology risk violations. Environment: Check Point Firewall (Power-1, UTM-1, Smart-1), Cisco ASA, Cisco IPS, Cisco Routers, Cisco Switches, Broadcom Proxy SG (formerly Blue Coat), Radware AppWall WAF, Forcepoint Web Security (formerly Websense), Tufin Firewall Monitoring, LAN/WAN, TCP/IP, VPN, Aruba Wireless, ISO 27001, PCI-DSS, SOX, NIST SP 800-53, Disaster Recovery Data Center EDUCATION Master of Science, Cybersecurity and Information Assurance Keywords: cprogramm artificial intelligence sthree information technology ffive hewlett packard microsoft mississippi Idaho New York North Carolina