Profile
14 years of experience in Information Technology
10 years of extensive experience with Sarbanes Oxley, PCI DSS, Corporate Security Management and IT Security Strategy Framework development.
Strong analytical Skills
Working knowledge of security technologies: Manhunt, Checkpoint (VPN & Firewall), Ever Dream, GFI languard, Net Recon, NESSUS, NMAP, TriGeo SIEM, PCI Express, Metasploit, Snort, Juniper IDP 200,Websense,Cisco ASA, FireEye, NAC and Encase Enterprise,Bit9, Mandiant, PKI, RSA, HP TippingPoint, ArchSight SIEM, Qualy’s Guard Security Scanner, CyberArk PasswordVault,Echoworks
Working knowledge of software/hardware including: Windows 2003/2008/2012, Windows 2000/XP/Windows Vista, Windows 7, LAN/WAN, Microsoft Exchange 2007/2010, Microsoft Outlook and Microsoft Office, UNIX/LINUX
Experience in current federal regulations related to Information Security, S-OX, GLBA, HIPAA
Certified Information Systems Security Professional
Certified Information Systems Auditor
ITIL-V3 Foundation Certified
ISO27001 Certified ISMS Lead Auditor
Checkpoint Certified Security Administrator
Application threat modeling and assessment
IT Security Policy, Procedure, standards writing and Compliance
Risk and Security assessment
Excellent knowledge of International Security Management Standards, e.g. COBIT, NIST, ISO17799
Strong vendor negotiations skills
Good oral and written communication skills
Lead many IT/Security Projects
Professional Experience
Global IT Security Advisor, Talisman Energy Inc., Calgary Alberta
August 2013-Present
Security Architecture Responsibilities
Plan and define the digital security architecture that protects Talisman’s information assets
Working closely with Talisman’s IT service providers to develop and implement adequate digital security architecture
Conduct Security Awareness training and authoring security awareness related documents
Conduct project reviews to ensure security requirements are met at every stage of the project
Analyze risks that may exist in systems that protect Talisman’s information assets
Consult and assess planned projects to provide guidance on how to adequately protect Talisman’s information assets
Capture requirements and develop appropriate documentation for security recommendations and projects
Risk Assessment Responsibilities
Conduct information security reviews, evaluations, risk assessments and develop recommendations for improvements as appropriate
Develop and execute remediation plans that addresses digital security related risks
Assesses digital security risks and develop business cases for solutions that address identified risks
Provide technical advice and assistance on information security and risk matters
Security Operations Responsibilities
Investigate and resolve security incidents
Advice on emerging information security technologies and issues
Assist with the execution of Talisman’s information security program and roadmap
Interact with service delivery teams in the realization of Talisman’s information security strategy
Advice and direct business users for security related issues on daily basis
Assist in daily Security Operations to protect Talismans’ assets
Managing network (FireEye, Mandiant, TippingPoint etc) security devices across multiple datacenters
Assist Legal and internal Audit department with E-Discovery projects
Lead Digital forensics investigations
Lead E-discovery projects
Create policies, standards and procedural documents
Participate in corporate compliance activities as needed
Implementation & integration of Cyber Ark PAM solutions
Work on Defining Access Control, User Entitlements, Manage Applications Credentials, User Access
Policy Management
Perform Privileged Access Reviews, Compliance Reporting, Access Control Processes and other associated tasks with Privileged User Management.
IT Security Analyst, City of Grande Prairie, Grande Prairie Alberta
August 2009-July 2013
Security Architecture Responsibilities:
Reviewed the City’s existing security architecture, noting all weaknesses and defects, recommended any changes needed to bring the architecture up to date and to correct flaws.
Conducted Risk Assessment for new and existing technologies, and Security Architecture
Implemented the necessary changes, and ensured (through regular reviews) that they stay up to date
Created and maintained IT security guidelines, policies, standards, and procedures, including standards for software
Updated the existing policies and standards as needed to reflect current industry norms
Developed publicity programs to acquaint City departments with the standards and their implications for each department
Developed security standards that meet third-party software package before it can be considered for use within the City
Developed and run security awareness program for the city’s employees to educate them about computer security and threats.
Business Continuity Planning Responsibilities
Conducted briefing sessions for departments, to describe the City’s IT Disaster Recovery Plan
Helped departments to align their individual plans with the City’s IT Disaster Recovery Plan
Provided any needed ITS services to help departments test their BCPs
Periodically, provided any needed assistance to departments to ensure that their BCPs remain current
Reviewed the Disaster Recovery Plan (“DRP”) as needed
Acquired needed hardware or software needed to upgrade existing facilities
Assisted set up an alternate Data Centre and data mirror facility at a location outside City Hall
Tested and ensure that the alternate facilities operate as intended
Conducted “Lessons Learned” workshops to analyze problems uncovered during the tests, and update the hardware, software and documentation as needed
Developed and implemented Change Management Process
Network Security and PCI compliance Responsibilities
Created processes, policies, implement tools to comply with PCI DSS
Conducted PCI audit to make sure all the systems and networks are within PCI compliance
Managed City’s Checkpoint Firewall and IDS/IPS
Managed CISCO ASA for SSL based VPN
Implemented, Managed TriGeo’s SIEM technology to protect City’s Network from unauthorized accesses
Implemented, managed and monitoring file integrity through Tripwire PCI Express solution
Implemented patch management solution for third party software (Non Microsoft)
Implemented, managed Websense Security gateway to bolster City’s network security
Implement Anti-bot solution to protect City’s information System from next generation threats
Implemented and maintained Encase Enterprise for security and internal digital investigations.
Scan the City’s network using Nessus vulnerability scanner to detect threats and vulnerabilities, create plan to mitigate the threats
Worked as Security Consultant to the City’s internal departments on Security and Privacy issues
Install and use software and hardware tools for real-time monitoring of the network, and ensure that the tools operate as intended
Managed third-party services to periodically test the network for weaknesses (vulnerability assessments and penetration tests), and use their findings to make necessary corrections to procedures and settings
Performed security audits as required for various City hardware and software components
Ensure that network security and operating standards meet PCI guidelines
Daily Reviewed security logs and reports, and take appropriate action to counter any detected threats or weaknesses
Stay current about new threats and new protective measures, and implement these measures when needed to ensure that the City’s network stays protected
Recommended additional measures (hardware, software) that will improve overall City security
Provided support to users for all security-related matters
Ensure that data stored in the City’s enterprise servers is adequately protected against unauthorized access
Developed general privacy guidelines for the City, and specific guidelines for departmental use (including guidelines for storage of documents; access by members of the public to data-sensitive office areas; and so on)
Updated ITS privacy procedures and guidelines as needed.
Reviewed operations of each department, identify privacy deficiencies, and suggest corrective action
Developed procedures where needed to help departmental staff to comply with the requirements
Arranged and managed on-going audits and inspections to ensure that departments continue to comply with the guidelines
Reviewed the applications being used by each City department (third-party packages or custom software) for adherence to City security policies and standards
Advises departments on the procedural and other changes they may need to make in order to be compliant with City security policies and standards
Managed vendors of deficient packages to obtain security-compliant updates or new versions of their products
Arranged for security updates to custom software that does not meet City standards
Participate in HR, Legal and Security Investigation using Encase Enterprise
IT Security Specialist, Valassis Inc., Livonia MI
Dec-2004-Nov-2008
Information Security Responsibilities:
Assisted with the creation and promotion of security policies, standards and guidelines
Adhered to established guidelines and processes related to hardware and software configuration, security procedures and compliance, and networking standards
Involved in various internal reviews of departments to understand their business process and applications and ensured that all information security controls were in place
Reviewed security logs and assisted Valassis staff to proactively address security concerns
Assisted in quarterly risk and vulnerability assessment projects
Managed information systems security involving the protection of intellectual property and systems integrity
Scanned and reviewed IDS logs on daily basis to protect critical infrastructure from internal and external threats
Monitored the internal control systems to ensure appropriate access levels are maintained
Initiated, facilitated and promoted activities to create information security awareness
Assisted with defining security requirements of new projects
Participated in Security Awareness Program to educate employees about security and protection of critical infrastructure from accidental or malicious threats
Involved in servers hardening to reduce the impact of security vulnerabilities and threats to the corporate critical information system
S-OX Compliance and IT-Audit Responsibilities
Participated in corporate internal audits and performed review and testing on all layers of infrastructure systems to ensure effectiveness of information technology general controls
Performed internal audit in a team environment; ascertained the reliability of developed IT applications and the related data processing functions; reviewed and evaluated the adequacy and efficiency of accounting, financial and operating procedures established for IT control purposes
Planned, performed and controlled the audit procedures that determine if the information system is in compliance with the IT policies; developed the audit programs; coordinated with the department being tested; and prepared and delivered the results of the audit in a written report
Network Security Responsibilities
Managed and configured Checkpoint Firewall/VPN-1 including remote locations
Responsible for building and troubleshooting Site to Site VPNs with customers
Managed and configured Juniper IDP 200 intrusion detection and Preventions system
Managed Websense web filtering for more than 3000 users to protect corporate information system
Monitored the internal control systems to ensure that appropriate access levels are maintained
Reviewed security logs and work with staff to proactively address security concerns
Assisted in security assessment of the external and internal network; recommended and assisted in remediation of security vulnerabilities
Windows Server 2003 Responsibilities:
Managed System Center Operations Manager 2007 for entire network
Monitored and tested vendor updates and patches to ensure compliance
Installed and upgraded software on client desktops and servers
Installed and configured Windows 2003 servers
Library Technician/Evening Manager, Walsh College, Troy MI
Sep-2001- Dec-2004
Supervised and Managed a group of 16 students employees
Provided telephone technical support for students/faculty regarding computer concerns
Provided maintenance and trouble shooting for user accounts using Microsoft Active Directory
Responsible for creating, trouble hooting and disabling of user accounts as member of a network provisioning team
Maintained instructional technology center with the Library
Issued and invoked student IDs in internal database system
Provided trouble shooting and performed software and hardware installation
Involved in root cause analysis of desktop, laptop issues and library software
Education, Training & Certifications
Master of Science, Business Information Technology, Information Assurance Specialization 2003
Walsh College, Troy MI
Certified by NSA and met the National Training Standards for Information Systems Security Professional
Review by the Committee on National Systems Security
CISSP-Certified Information System Security Professional
CCSA-Checkpoint Certified Security Administrator (NGX)
CISA- Certified Information Systems Auditor
ITIL-V3- ITIL-V3 Foundation Certified
ISO27001- Certified ISMS Lead Auditor
Training- Checkpoint Certified Security Administrator Level I&II
Training- Encase Computer Forensics I-Guidance Software
Training- Encase Computer Forensics II-Guidance Software
Training- Encase E-Discovery-Guidance Software
Training- Network Security training – Digital Boundary Group London, Ontario
Training- Microsoft Windows Network Hardening training -Digital Boundary Group London, Ontario
Training- SANS- Computer Forensic Essentials
Training- Five days In-house Project Management Training
Training- ITIL0V3 Foundation
Training- SAP FICO-Implementation and Configuration
Training- Oz Training for Accountability (Oz Principal)
Training- Essential Skills for Supervisors-Northern Lake College Slave Lake Alberta
Training- SQL Server 2008 Transact –Winding River Edmonton Alberta
Training- Managing Windows Environment with Group Policy-Global Knowledge
Certifications Working on: CCSE, CISM
