Timothy Batts

● Owned the evolution of incident response by building workflows, refining controls, and improving detection logic to support compliance with SOC 2, HIPAA, PCI DSS, and ISO 27001 ● Served as the final escalation point for major incidents, leading investigations, root cause analysis, and executive-level reporting focused on CIA impact ● Tuned Sumo Logic EUBA and detection rules to reduce false positives and expand MITRE ATT&CK TTP coverage across critical attack paths ● Built a formal post-incident review program tied to KPIs and cross-functional improvement efforts, including structured lessons learned sessions ● Rolled out and fine-tuned Mimecast to boost detection and response to phishing, malware, and targeted email threats ● Managed compliance documentation and evidence for more than 70 security controls during internal and external audits ● Used Jira to drive IR project tracking, improve workflows, and report on operational KPIs within Agile and Kanban frameworks

● Oversaw 24/7 SOC operations with a team of Tier 1–3 analysts, providing mentorship, career guidance, and performance development that led to multiple internal promotions ● Led the end-to-end migration from Splunk to Exabeam, building detection rules, dashboards, and response metrics to sharpen visibility and reduce response time ● Tuned Exabeam’s behavioral models to achieve broad MITRE ATT&CK TTP coverage, validating improvements through Atomic Red Team exercises ● Built Python automation for GCP IAM and firewall triage, cutting alert analysis time by over 90% and boosting SOC efficiency ● Designed SOAR workflows in CrowdStrike Fusion to streamline alert enrichment, escalation, and ticketing workflows ● Partnered with GRC and audit teams to support compliance efforts, including SOC 2, PCI DSS, HIPAA, and vendor risk assessments ● Ran security awareness campaigns and phishing simulations, tracking performance using KPI-driven metrics and reporting ● Acted as the final escalation point for both digital and physical security incidents, leading investigations and writing detailed post-incident reviews ● Supported malware detection and IOC tuning through DAST, SAST, and IAST assessments ● Reviewed IAM, firewall, and cloud project configs across GCP, Azure, and AWS to improve posture and enforce least-privilege access ● Regularly triaged alerts from Azure Defender and Microsoft Cloud App Security, contributing to ongoing threat hunting and cloud monitoring efforts ● Managed project tracking and team workflows using Monday.com within Agile and Kanban structures

● Investigated and triaged alerts across tools like CrowdStrike, Splunk, Proofpoint, GCP Security Command Center, and Zscaler to support daily SOC operations ● Tuned detection rules and refined IOC/IOA logic to cut false positives and improve response accuracy ● Used BloodHound to uncover Active Directory privilege escalation paths and Kerberoastable accounts, supporting access control improvements ● Maintained SOC playbooks, shift handoff documentation, and standard operating procedures to drive consistent response workflows ● Led proactive threat hunts to surface attacker footholds and emerging behaviors across the environment ● Mentored junior analysts on triage methodology, detection logic, and procedural adherence to raise team capability ● Oversaw physical security alerting and CCTV system monitoring for over 140 remote and on-site locations ● Tuned Spirion DLP alerts to better detect and respond to PII and PCI DSS-related violations

● Triaged and prioritized FortiSIEM alerts to support SLA commitments across a range of MSSP clients ● Ran vulnerability scans using OpenVAS and provided remediation guidance based on risk severity and client environments ● Built foundational experience in PCI DSS compliance, incident documentation, and delivering client-facing security support