Martin R.

SOC services for critical infrastructure protection IBM QRadar

Claroty SME: Full lifecycle administration of CTD (OT IDS) and SRA (PAM) in industrial environments. Vulnerability & Risk Mgmt: Identifying, analyzing, and reporting OT-specific vulnerabilities and risks to global customers. OT SOC & Reporting: Monitoring ICS/OT networks; developing security dashboards and translating technical alerts into operational risks. Consultancy: Technical lead for Claroty implementations and project delivery for external industrial clients.

Threat Monitoring & Analysis: Monitor real-time security events and alerts using SentinelOne tools. Analyze logs and security data to detect anomalies and potential threats. Triage and investigate incidents promptly, focusing on containment and mitigation. Incident Response: Participate in hands-on incident response, executing predefined steps to contain and remediate threats. Conduct detailed investigations to determine the root cause of incidents. Document incident findings and update incident logs for future reference. Cloud & Container Security: Monitor and support security measures in AWS environments. Assist in overseeing the security of Kubernetes-managed container environments. Collaborate with IT teams to apply necessary security controls and updates across platforms. Operational Collaboration: Work closely with peers and IT staff to ensure effective security monitoring without managerial oversight. Provide technical insights during incident reviews and debriefs. Maintain up-to-date documentation of processes and incident handling procedures. Tool & Process Support: Support the ongoing tuning and of SentinelOne and related security tools. Provide feedback and assist in refining operational processes as an integral team member.

Development and implementation of a cybersecurity framework for biofuel production plants in Slovakia, Poland and Hungary, for both IT and OT environments. Collaboration on cybersecurity audit to assess the current state of IT/OT infrastructure and existing security controls against regulatory requirements to identify critical gaps. Translation of audit recommendations to technical, administrative and physical security controls based on existing architecture and available resources. Creation of an implementation roadmap prioritized on business impact and resources. Management of technical specification development, market research, budget definition, presentation of strategic plans to executive management for approval, management of procurement process, all while managing day to day security operations across the plants.

End to end management of detected security incidents, analysis of logs, events, users input, complementary research and application of logic and intuition. Containment and eradication of found true positives and mitigation of damage to the company. Security incident lifecycle report creation, documentation and management of build in house knowledge base. Continual sharpening of security tools in cooperation with responsible security departments. Provisioning of support and advice to end users and IT, engineering, management or business departments. Cyber threat intelligence analysis. Intervention in case of security compliance violation. Physical security management in case of stolen/lost company devices. Monitoring of insider threats and further cooperation with CISO, management, HR or/and legal departments till resolution. Occasional threat hunting, user awareness campaigns and participation in purple team assessments. Completion of any ad-hoc security task that might land on my table.

Learning the trade, following step by step guides. Learning the how and overtime learning the why. Absorbing security knowledge, adding dots and connecting them. Asking a lot of questions, attending trainings and achieving certifications, all while having a lot of fun.

Web application penetration testing

Major incident process manager role, support of wide variety of IT infrastructure. Definition of major incident strategy and its end-to-end implementation. Identification and removal of obstacles in the process and process implementation. Major incident process training of respective Service Owners/ Managers and Major Incident Key Users. IT services and major incident administrative onboarding into ServiceNow. Infrastructure monitoring strategy development, vendor evaluation and major incident process integration. KPIs definition, data analysis and Power BI reporting management. IT transition projects cooperation. Yammer major incident group management.

Major incident manager role, single point of contact for global IBM client, responsible for end-to-end management of severity 1 & 2 incidents. Leading and/or participating in bridge calls with different technical/business/ service teams and clients. Gathering of technical information from investigation progress. Translation of technical language into business language and information of stakeholder via major incident notifications. Management of escalations, responsibility for prioritization based on business impact, revenue loss and customer needs, with high emphasis on agreed SLAs. Responsible for fulfillment of agreed terms and processes for both customer and vendor sides. War room leading, work with clients/vendors/own ticketing tools.

Technical project management role, responsible for management of service requests for network (LAN, WAN, Managed Security Services - Firewalls) services per established service processes. Coordination of received service requests based on priority and available resources, review of technical documentation with technical teams, validation of service requests on CAB meetings, service requests implementation supervision, postimplementation approval, billing triggering and database maintenance. Responsibility for negotiation of shared expectations among customers, sales and supporting work centers. Communicating expectations to all organizations providing services to the client. Partner with Network Operations, Business Operations and billing environments to ensure that the requested network services are correctly implemented. Project coordination and decision-making (small to middle size projects). Management of complex life cycle delivery with a focus on high speed and emerging services. Full accountability of all escalation and expedited situations for implemented services. Ownership and management of the customer experience. Order status and tracking, relationship management, Center of Excellence (COE) partnership management, identification of process obstacles and coordination of resolution actions.

Datacenter server infrastructure environmental parameters monitoring, backup plan triggering in case of an incident + escalation in case of a major incident, reports writing.

Order processing and transport organization of Kraft Foods products to Spain, Portugal and Greece. Phone and email communication with clients and carriers from all over Europe. Transport prices haggling and management of already existing transport lanes.

Thesis: Claroty Continuous Threat Detection as a Technical Security Control for NIS2 Compliance in Critical Infrastructure

Thesis: Security Incident Response

Madrid, Spain