Okay so, I know that some of my co-workers may be watching this, but...
I'm passively putting out feelers for new work.
I've not been fired, and perhaps I should be thankful for that, given the job market and all, but I'm going to try anyway.
I'm also going to be upfront that I'm looking for more pay and career advancement, because I have goals I want to achieve.
I'm looking for senior/principal level cybersecurity roles, but also, I could be convinced to do team lead/managerial roles in order to pass knowledge on to the next generation, as I love teaching, and passing knowledge on to others. I have 15 years of experience in security in general, with another 6 odd years of systems administration on top of that in my early career.
Whatever I would hypothetically do for, or with you would have to be remote. Michigan is my home and I refuse to leave it. I also have senior dogs that need a close eye.
- What I do extremely well:
Network Security Monitoring - I'm extremely well-versed in Snort and Suricata, and have a great understanding of Zeek IDS and IPS platforms and everything that comes with them. Deployment, Administration, Detection Engineering, Investigation, etc. If you give me pcaps, I can rip them apart in moments to find the relevant data. You give me IDS alerts and I can do the necessary correlation with other security tools and logs to figure out what happened, and build a timeline.
Security Operations/Blue Team ops - If you have logs, I have ways of making those logs talk. I'm most well-versed in Splunk -- that is to say that stats is a hammer by which every threat hunting session gets nailed, but I can adapt to whatever you use for gathering your logs. I've handled incident investigations and have assisted clients on what needs to be done next on every stage of the DFIR lifecycle
Threat/Vulnerability Research - This goes hand in hand with detection engineering talent. Distilling the data from security research articles, proof of concept exploit write-ups, malware sandbox reports, online threat intelligence platforms, and everything else in between. I have demonstrated ability to determine the relevance of the threats, and extract the actionable indicators for detection engineering.
Avid writer and speaker - I've presented at plenty of security conferences, podcasts, streaming platforms, etc. I've authored my own video training, and self-published multiple books that have been well-received by the community. I've run my own blog for years, but also have had my work featured on more professional company blogs throughout my career.
Virtualization and Homelabbing - A lot of what I do requires having a place to reproduce exploits, exploit conditions, and test out security tools. I've written two books on virtualization and home labbing. I'm also somewhat well-versed on setting up a sandbox on both VMs and physical hardware to get around anti-VM nonsense some malware authors do.
Documentation - I hate figuring out how to do something, then having to do it again later only to have completely forgotten how to do it. I hate finding half-assed documentation for a product that doesn't cover major use cases, or doesn't have good documentation for important edge cases. So when I figure things out, its getting written somewhere for future reference. With lots of screen caps for further guidance.
Data pivoting - Given a number of IOCs of any kind, I'm well versed in turning that into more actionable data for more detection engineering.
- What I do pretty decently:
Host-Based Detection and Analysis - I'm somewhat well-versed on how to make use of yara rules as they're kinda required to do any valuable hunting in Virustotal. If you have Linux audit logs, windows process execution logs/sysmon, other AV/EDR logs, sandbox reports detailing parent/child process relation ships and what command are being run or where files are being dropped, I can figure things out well enough.
Honeypotting/Honeytokens - I'm pretty good at watching the bad guys do silly things with boxes they think they've owned.
- What I'm just okay at:
Programming - Given enough monkeys and enough typewriters, I can write some automation tools in Python. I've contributed to two open-source projects in a very minor capacity. I've written a tool that helps automate some aspects of Suricata rule writing for me. The good news is that if I don't know what I'm doing, I'm not afraid to ask for help after trying to find the answer myself, then documenting it.
Cloud/Devops stuff - I know enough about cloud computing to understand what functionality maps to whatever stupid cloud application name your cloud provider of choice chose to give that function. I can grok the purpose, I can probably figure out cloudtrail logs for security anomalies and other weird issues, but I have never administered cloud infrastructure myself, personally. I'm also versed enough to figure out how to use whatever containerization solution du jour is popular this week, but the minute I have to figure out why they aren't working, or what has gone wrong, I will scream in frustration because of how terrible the instrumentation, logging, documentation and other troubleshooting apparatus are.
Buzzwords - Zero trust is, and always will be Identity and Access Management
SBOM will always just be software prerequisites.
Web3 will always be scams, with more steps
AI will always be markov bots but with stolen data baked in
What I refuse to do:
AI - I refuse to be told that I must use AI to do my job. That I must have some form of AI usage as a trackable metric for performing my duties. I active avoid using it in any aspect of my life because I refuse to offload my critical thinking to a chatbot. I refuse to work for companies that make AI their identity. I refuse to work for AI companies at all.
Web3/Cryptocurrencies - Web3 and cryptocurrencies are a net negative to every single thing they touch, and I refuse to be affiliated with any of it.
Anything involving clearances or Defense Industrial Base contracting - Been there, done that. The mission doesn't put food on the table when you're furloughed for weeks and months on end because congress can't act like adults and solve their problems. I also do not want to touch anything involving the current administration with even a barge pole.
Contract roles in general - Sorry, I need permanent employment, and I need healthcare of some sort.
last time I checked about tennish years ago, I was told that I have been blacklisted from Cisco, so I cannot work for Cisco or any of its holdings. If you don't know the story, I 'm more than willing to tell you publicly or privately.
Other notes:
I don't have specific experience with specific security appliances like Cisco, Palo Alto, Juniper, etc. But again, I'm far enough along into my career to where if I was required to learn how to use specific security products, I can read the docs, do the training, or observe how others do it to figure it out for myself.
Education level is bachelors degree with a number of outdated certifications
If any of this tickles your fancy, DM me, or e-mail at deusexmachina667 at gmail dot com