Kumail Rizvi

• Senior Security Engineer at Penn Medicine - University of Pennsylvania; an Ivy League institution with a $21 billion endowment and home to The Wharton School, the world’s first and most prestigious collegiate business school. o Served as Subject Matter Expert (SME) for CrowdStrike and worked extensively with Illumio, F5, BeyondTrust, Intune/SCCM, Microsoft Defender for Endpoint, Palo Alto IoT, Microsoft IoT, Imperva, Google SecOps, SpyCloud, CyberArk, Mimecast, and Palo Alto Panorama (including AI-driven threat analysis). o Directed enterprise-wide CrowdStrike deployments across major hospital networks, including Hospital of the University of Pennsylvania, Princeton Health, Lancaster General, and Doylestown Hospital, each with distinct infrastructures, security policies, and operational constraints. o Led the enterprise rollout of Armis, collaborating with cross-functional teams to position it as the primary endpoint security and asset visibility platform across the organization. o Eliminated 99% of duplicate CrowdStrike hosts (thousands of instances) by reimaging VDIs, correcting agent misconfigurations, and enforcing uniform deployment standards, significantly improving detection accuracy and reporting integrity. o Built a centralized enterprise endpoint asset repository by integrating Active Directory, Device42, SCCM, Intune, and CrowdStrike data, increasing asset visibility coverage from ~70% to over 98%. o Conducted annual CrowdStrike audits to ensure configuration alignment with enterprise security baselines, compliance frameworks, and audit readiness requirements. o Standardized endpoint security policies across diverse environments, closing legacy security gaps and aligning configurations to enterprise-wide hardening standards.

Selected by CompTIA to serve as a Subject Matter Expert (SME), contributing professional expertise toward the continued development and validation of industry-recognized IT certification standards. Activities performed in accordance with CompTIA’s SME confidentiality and ethics guidelines.

Includes Personal Projects and Short/ Long term Contracts: Security Consultant (Atos, Wipro, ServiceNow Partnership) - Led strategies for Network Security, Endpoint Security, SOAR, CSIRT, and Cloud Security remediation. - Optimized incident ticket processes by reconfiguring and fine-tuning ServiceNow backend systems. Automated workflows to enhance incident management efficiency and reduce response times. - Developed custom scripts/integrations for advanced ServiceNow security monitoring and reporting. - Delivered user training to maximize effective incident management via ServiceNow. Security SME (Microsoft, Verizon Partnership) - Conducted in-depth security assessments to enhance cybersecurity frameworks and resolve vulnerabilities. - Led POCs with Microsoft engineers as an SME for tools like Azure Security Center, Microsoft Defender ATP, and Microsoft Cloud App Security. - Provided expert guidance on implementing Microsoft security tools to strengthen client security postures. - Formulated tailored strategies and best practices to meet unique client cybersecurity needs. Technology Leadership Development Program Candidate (Travelers) - One of three candidates selected from Connecticut for a prestigious program focused on forensics, penetration testing, and vulnerability management. - Acquired skills in incident response, threat intelligence, and risk management using RSA Archer. - Enhanced compliance with GDPR, HIPAA, and NIST standards via risk assessments and mitigation strategies. Lead Tanium Consultant (Brook Source, AZDOHS) - Collaborated with stakeholders to implement security tools across Arizona counties. - Developed standardized procedures to ensure consistent and effective deployment of security solutions. - Trained local IT teams to adopt and manage security tools, improving threat response capabilities. Cybersecurity Awareness Leader - Partnered with universities in New England and California to deliver workshops on advanced threat handling.

• Lead Cybersecurity SME for Wells Fargo, The fourth-largest multinational financial services company in the world by market capitalization - $181.3 billion. o Served as SME for the AI/ML Cybersecurity department, leading 4 teams and overseeing 9 AI models to secure the enterprise’s digital infrastructure against evolving threats. o Represented the department in enterprise-wide strategy meetings, collaborating with 15+ teams and 50+ senior stakeholders to identify threats, address gaps, and enhance tools via penetration tests, threat modeling, and vulnerability assessments. o Championed the integration of GCP Gen AI for future models, partnering with Google to develop scalable, advanced cybersecurity solutions. o Helped with the design and deployment of $20M AI-driven security models, reducing incident response times by 30%, improving detection accuracy by 40%, and mitigating risks for 250,000+ employees. o Reviewed and validated Model Development Documents (MDDs) with data scientists, ensuring alignment with security objectives, compliance standards, and enterprise needs. o Built models for DLP attack analysis and user activity monitoring, detecting 95% of malicious patterns and closing security gaps for 250,000+ users. o Conducted hyperparameter tuning and optimized anomaly detection, reducing noise by 99% and delivering high-fidelity results for security operations. o Created Power BI dashboards for 4,000+ users, providing actionable insights and streamlining executive decision-making. o Led Wells Fargo’s transition to AI-driven security, reducing false positives by 95% and setting new benchmarks for real-time threat intelligence and machine learning integration.

• Lead Endpoint Security Engineer for National Grid, the world’s largest investor-owned Electric/Natural Gas Company ($22B annually). - Led the migration from FireEye to Microsoft Defender, securing 50,000+ endpoints, one of the company’s largest cybersecurity upgrades. - Primary Tanium Engineer for transitioning 50,000+ US/UK endpoints from Windows VMs to Linux appliances. - Managed 50,000+ security tool health inspections (CyberArk, Tanium, Qualys, CrowdStrike, Splunk, FireEye, McAfee, Palo Alto, Symantec) ensuring compliance and performance. - Directed incident response with a 100% resolution rate, leading security enhancements and proof-of-concept evaluations. - Strengthened security posture with GPO, Tanium, Defender, Applocker, Zscaler, Intune, CrowdStrike, reducing incidents by 23% and optimizing Vulnerability Management for executive reporting. - Partnered with Security Architecture, using Splunk for log analysis and enhancing incident response strategies. - Secured AWS environments with IAM policies, security groups, and CloudTrail/CloudWatch, ensuring CIS compliance. - Expertise in Threat & Vulnerability Management (Qualys, Defender) and IAM-PAM solutions for RBAC enforcement. - Conducted security assessments (Rapid7, Nessus) and assisted SOC in threat handling and remediation. Developed security policies and procedures for employees, IT, and customer interactions. - Technical Escalation Lead for Endpoint Protection Services (Tanium, FireEye). - Provided National Grid CSIRT training and Tanium module enhancements (Asset, Interact, Comply, Connect, Discover, Enforce, Performance, Threat Response, Trends). - Led Tanium support case resolutions with Technical Account Managers (TAMs) across US/UK shifts. - Created high/low-level architecture documents detailing system configurations and security controls. -Led on-call support, SOP development, and knowledge transfer, integrating ServiceNow, Jira, and SharePoint for incident and change management.