Raymond Douglas

Cyber Security Analyst - (Night Shift Senior Lead) • Monitor real-time network traffic identifying malicious activities utilizing tools such as Splunk, Fireeye, Crowdstrike & Cofense Triage • Respond to inbox alerts retrieved from Outlook & escalate or them to Incidents using the Service-Now ticketing system • Investigate activity utilizing splunk’s proxy search functions such as; Epo data searching, IDS log, Windows login events via Host IP, Hostname or I.D. Pin, VPN Session via username, firewall proxy & examine & report email using Splunk’s Sophos Pure-message dashboard • Utilize Splunk Analyst Dashboards to review, investigate & report of hosts, source & destination I.P. & usernames • Investigate and identify external foreign IP addresses utilizing Akamai WAF software • Inspect external IP addresses using web tools such as MWG Trusted Platform, virustotal, IPvoid, DNSlytics & Central Ops for whois results • Search and reply for priority based alerts, identifying the severity of misc situations  to be investigated, escalated or forwarded to the appropriate team or immediately remediated retrieved from Microsoft Outlook • Review, investigate, respond & remediate antimalware events alerted from Trend Micro software • Proactively block malicious IOC's such as domain, IP & hash based activity.

• Monitor real-time network traffic to identify anomaly’s and malicious activity using Sourcefire , Splunk & FireEye • Respond to inbox anomaly/malicious alerts retrieved from Splunk to Outlook & escalate them to SIEM events using the resilient ticketing system • Investigate activity utilizing splunk’s proxy search functions such as; Epo data searching, IDS log, Windows login events via Host IP, Hostname or I.D. Pin, VPN Session via username , firewall proxy & examine & report email using Splunk’s Sophos Pure-message dashboard • Utilizing Splunk Analyst Dashboards to review, investigate & report of hosts, source & destination I.P. & usernames • Scan, review, investigate & or block suspicious/malicious ingress or egress traffic • Report & investigate High Risk URL • Submit URL & Files using Fireeye MAS (Malware Analysis System) • Investigate and utilize external IP address using web tools such as MWG Trusted Platform, virustotal, IPvoid & Central ops for whois & ping results • Investigate & report malicious signatures, signature I.D’s , IP addresses (ingress & egress attempts) • Utilizing Splunk to Review 24 hour DMZ flow data & data attacks, ping sweeps, IP fragments that may be allowed & Rejected event logs • Make use of application tools such as FireEye, Tanium, Wireshark etc… to perform traffic & malware analysis. • Submit Memory/RAM Capture using Host names combined utilizing Resilient or HP Service Manager CAPRS ticket numbers for submission • Use FireEye NX (Network security & Forensics Solutions) IPS to investigate, report email & IP addresses • Investigate emails/ accept inbound calls for DHS US-Cert upon request. • Utilize Stealth watch to capture and report rogue hosts & malicious brute force activities • Analyze and report internal SSA host machines using the SSA SCCM network tools to harden host machines as well as watch for vulnerabilities caused by out of date applications. • Utilize several programs to assist with monitoring IDS,

• Create, track, & dispatch tickets utilizing the HP Service Manager "CAPRS" system. • Perform system password resetting utilizing Active Directory, PCOM (Mainframe), Checkpoint Endpoint security, & McAfee encryption applications. • Unlock/Decrypt encrypted removable drives utilizing the McAfee checkpoint endpoint security program. • Utilize Nortel VOIP phone systems to dial out or transfer calls. • Create & dispatch priority based alerts for SSA employees nationwide. • Dispatch hardware from venders such as: Lexmark, Dell, & Hewlett Packard nationwide. • Work closely with the SSA’s ROCC & NOC sites to solve network based situations. • Assist troubled users using their IP Address or Network (Computer) names using the remote online application’s Microsoft System Center Configuration manager 2007 Remote Control & Remote Desktop. • Add & remove users to and from domains utilizing Windows Server 2008, & 2012 OS. • Create Outlook profiles for SSA employees nationwide. • Rebuild & configure SSA user’s profiles utilizing Windows Server 2008, 2012 & Windows 7 OS. • Verify & view SSA Employee's by using the SSA DISSAO web application "Pin Viewer". • Verify & view SSA workstation hardware using the SSA DIET web application "SCCM 2007 Inventory". • Configure & update internal SSA employee peripheral devices, drivers, and software. • Utilize Active Directory to transfer or create workstations/computers to and from different OU's (Organizational Unit's)/containers • Utilize Spark & Lync messaging programs for update & emergency practices. • Adjust VOD (Video on Demand) servers using the in-house version of the WS-Info application. • Use MS Outlook to send, view and attach emails and documents. • Support & dispatch SDS (Single Device Solution) workstation hardware via Dell Inc.

• Utilize the CAPRS ticketing system to view, track, & dispatch Single Device Solution (SDS) Laptop machines to the Point of Contact (POC). • Utilize the UPS Campus ship website to create shipping or return labels or pull and print receipts if necessary. • Email the SSA’s laptop vender “NCST” using Microsoft Outlook for each individual ticket to receive replacement hardware in order replenish laptop stock or in rare cases peripheral devices such as monitor’s or docking stations. • Carefully label and match each returned hardware with its barebones unit received from SSA’s laptop vender NCST to replenish stock. • Swap new internal hard disk drives from NCST into laptops with broken/defective parts or with pre-existing windows operating system images. • Document & organize documentation such as (UPS receipts, Dispatches & Incoming paperwork) • Train new employee's the policies and procedures on documentation and properly handling dispatches or returning of hardware, as well cater to each individual ticket as needed. • Adjust the location of hardware using HP Asset Manager (HPAM) for tracking or record purposes. • Work closely with the branch chief (Regina Franki) & Team Leaders to accomplish which paths to take to make sure we are delivering the most efficient and positive way to get hardware to and from the point of contacts & sites on a weekly basis

• Create, track, & dispatch tickets utilizing the CAPRS system. • Perform system password resetting utilizing Active Directory, PCOM (Mainframe), Checkpoint Endpoint security, & McAfee encryption applications. • Unlock/Decrypt encrypted removable drives utilizing the checkpoint endpoint security program. • Utilize Nortel VOIP phone systems to dial out or transfer calls. • Create & dispatch priority based alerts for SSA employees nationwide. • Dispatch hardware from venders such as: Lexmark, Dell, & Hewlett Packard nationwide. • Work closely with the SSA’s ROCC & NOC sites to solve network based situations. • Assist troubled users using their IP Address or Network (Computer) names using the remote online application’s Microsoft System Center Configuration manager 2007 Remote Control & Remote Desktop. • Add & remove users to and from domains utilizing Windows Server 2012 OS. • Create Outlook profiles for SSA employees nationwide. • Rebuild & configure SSA user’s profiles utilizing Windows Server 2012 & Windows 7 OS. • Verify & view SSA Employee's by using the SSA DISSAO web application "Pin Viewer". • Verify & view SSA workstation hardware using the SSA DIET web application "SCCM 2007 Inventory". • Configure & update internal SSA user's peripheral devices, drivers, and software. • Utilize Active Directory to transfer or create workstations/computers to and from different OU's (Organizational Unit's) • Utilize Spark & Lync messaging programs for update & emergency practices. • Adjust VOD (Video on Demand) servers using WS-Info application. • Use MS Outlook to send, view and attach emails and documents. • Support & dispatch SDS (Single Device Solution) workstation hardware via Dell Inc.

• Troubleshoot & resolve tier I & II customer issue’s or escalate as appropriate • Respond to telephone calls, email and other requests for application or technical support • Assign tickets for clients, Field technicians & technical coordinators through phone calls or AACO helpdesk email. • Provide ticket updating , reassigning, call transference for the clients & other help desk co-workers • Track & monitor requests, ensuring a timely resolution • Receive, document service requests & customer information the ticket system “HEAT” • Provide software & or hardware resolution for Anne Arundel County desktop, laptop & supported software • Perform password resetting for all Anne Arundel County clients utilizing Novell or Gmail servers. • Conduct follow-up activities with the customers in the form of emails and/or phone calls to close tickets • Support host and Web-based applications • Resolve problems, duplicate client issues, troubleshoot and escalate problems as needed • Provide online phone support using on-line conferencing tools • Utilize various tools to remotely access customer equipment

• Occasional software and hardware upgrades, such as Microsoft office suite applications • Perform password resetting, virus removal and maintenance such as malware, Trojan and adware • Perform moves, adds or changes (MAC’s) including maintenance on internal desktop & appliance hardware such as hard drive, GPU/video card, Ram, CPU (Central Processing Unit), motherboard, keyboard, mouse, printer and monitor swapping, installation or failure detection • Install and repair video equipment, network connections, printer, etc… • Reformat, partition and transfer the data from the hard drives via zip drive or disk format if or when necessary. This also includes imaging the machines via Windows OS • Troubleshoot drive issue failures of the devices

• Route, install, patch, terminate & label CAT5e & 6 cabling • Demonstrate the proper use of hand and power tools to install cabling as well use tools such as (drills, fish tape and utility knives) • Communicate with customers through various means (oral, written and electronic)

• Installing, troubleshooting analog phone lines, assembling and programming Avaya VOIP telephone (1140e and 1120e) • Assembling and installing wireless intrusion detection systems (WIDS) antenna • Troubleshoot using fluke Time Domain Reflectometer (TDR), along with Fluke probe and toner’s • Install, patch and organize 24 and 48 port 2950 and 2960 series cisco switches • Gigabit GBIC switch installation

• Setup, route, install and maintain Cat5e,Cat6, fiber, plenum, riser and backbone cabling, • Utilize hand and power tools to install cable (drills, fish tape, utility knives, and drywall saws). • Termination and installation of cabling termination using the standards for voice and data (110 block panel, 55 block and 568B) • Install, patch and organize 24 and 48 port 2950 and 2960 series cisco switches • Gigabit GBIC switch installation