Information Security Cyber
Resume:
Derrick M. Age, CASP, Linux, Six Sigma, CTGA, CEH Network + Security + etc.
Email: *******.***@*******.*** Telephone: +1-817-***-****
LinkedIn Profile: https://www.linkedin.com/in/derrick-age-8a3b548/
Introduction:
A proven leader in the field of cyber security advisory, security risk management, governance, and compliance with over sixteen years of experience with several large organizations in banking, finance, healthcare, hi-tech and retail industry.
Enabled business by establishing robust information security and enterprise compliance programs.
Experienced in transforming enterprise culture of large, medium, and small enterprises to “Security First” culture.
During advisory and other positions, elevated enterprise security and compliance posture of both, on-premises, and cloud-based infrastructure & applications, through successful execution of information strategies.
Skilled and effective communicator on information security and compliance topics at all levels of the organizations.
Developed and matured security and compliance teams, policies, procedures, and infrastructure for large and medium size organizations.
Led and advised some of the largest organizations in banking, finance, healthcare, retail, and process industries in solving complex information security challenges and security incident handling.
In depth information security industry knowledge and industry credentials as information security and compliance subject matter expert.
Successful track record in leading and managing enterprise information and cyber security teams.
Pragmatic leadership approach in managing information security risks.
Qualifications Summary:
Over fourteen years of progressive experience in Cyber security, IT Security, IT risks assessments, IT Governance, & Compliance assessments, including healthcare, large banking, finance, and hi-tech organizations including both, on-premises and cloud-based infrastructure and applications.
Provided successful strategic and tactical leadership for information security, IT compliance programs, architected and deployed large-scale security solutions, and managed growth of maturity for large and small enterprises.
Areas of competency:
Information and cyber security
Enterprise risk and threat management
Security policies and governance
Information strategies & data management
Global compliance management
Experienced in supporting regulator examination.
Responsible for all aspects of information security. This includes security solutions architecture, implementation of a corporate-wide information security program and the associated ongoing processes resulting in the preservation of the availability, integrity, and confidentiality of all information assets.
Strong knowledge of several information security related frameworks, and in-depth knowledge of PCI-DSS, GLBA, HIPAA, HITECH, MDS2, NIST SP 800-53, SSAE 18 SOC1, SOC2, SOC3, CCPA, GDPR, ISO 27001, ISO 27002, ISO 27701, NIST 800-171, NIST-CSF, FedRAMP, EI3PA, FFIEC, SIG, Sarbanes-Oxley (302, 404)/COBIT.
Designed, led, and implemented enterprise threat management and threat mitigation, including deployment of advanced security tools such as CrowdStrike, Cylance, Netskope, NH-ISAC threat management, insight Partners, PhishMe, etc.
In-depth knowledge of information security risk management, risk assessments, risk mitigating and compensating controls and risk metrics.
For large and medium enterprises, I have led, managed, and performed Risk Management functions, including performing risk assessment using a framework such as NIST Risk Management Framework (RMF).
Extensive experience in establishing and operating Third-Party Information Security programs and assessments using AUP, SIG, EI3PA, etc.
Led implementations of advanced information security solutions and defenses, including cloud-based and on-premises Web Application Firewall (Incapsula, Imperva), Anti-Phishing (Inky, PhishMe), endpoints geo-fencing and GPS based endpoint tracking and control (Absolute), Cloud Access Security Brokers (OKTA), cloud DLP (Netskope, etc.), and Artificial Intelligence (AI) based advanced malware detection solutions (CrowdStrike, Cylance, Trillex, Crowdstrike, Malwarebytes etc.).
Led several successful and effective awareness training and campaigns.
Led assessments and implementations of Business Continuity Planning/Disaster Recovery Plans, Crisis-Management Plans, Incident Response Plans and Problem Management Plans.
Led and managed implementations of Governance, Risk and Compliance solution for Fortune 500 customers.
Information Technology Security Skills:
IT Governance, Risk and Compliance:
PCI-DSS, GLBA, EI3PA, FFIEC, SIG, Sarbanes-Oxley (302, 404)/COBIT, NIST SP 800-53, SSAE 18 SOC1, SOC2, SOC3, CCPA, GDPR, ISO 27001, ISO 27002, ISO 27701 Privacy framework, HIPAA, HITECH, MDS2, NIST 800-171, NIST-CSF, FedRAMP, Enterprise Governance, Risk & Compliance package implementations, etc.
• Cloud Security, Security Engineering, Log Monitoring, Security Incident Management, Business Continuity/Disaster Recovery, Crisis Management, Problem Management, Security Information Management, and Security Scanners.
• Enterprise security threat and risk assessments, Information Security Policies & Procedures, IT Governance, Identity and Access Management, Server security, Network security, Endpoint security, Mobile Device security, Data Security, Key Management, Vulnerability Management/Patch Management, Antivirus, Data Loss Prevention, Application Security, Change Management, Physical Security, Workstation security and Removable Media Security
• Secure Software Development Life Cycle (SDLC), DevSecOps and OWASP.
Built out and established SOC for COD and built out Fusion center for DPD and CJIS environment. Built out all security play books with Palo Alto.
Established email security and built out Pam solutions for CyberArk, Centrify and Beyond Trust.
Built SSO solutions with Duo and Okta.
Built out all framework for Identity and access management for COD and COH.
Built out ARMIS for IOT devices on the network.
Implemented Ise segmentation for users and applications.
Set up NetScout taps for the organization for segmentation.
Education:
Master of Science – Information Technology Management - University of Phoenix – Graduated Summa Cum Laude, Dean’s list
Bachelor of Information Technology -University of Phoenix – Graduated with the Highest Distinction
Professional Experience:
COD August 2020 - Present
Deputy CISO and Interim Director over Security Operations and Identity access management
Responsible for the global information security for the enterprise. Engaged to build a global information security program and team for a leading eCommerce platform with over 100,000 distributors and several millions direct consumers in over 6 countries. Additionally, responsible for security compliance, cyber security risk assessments and management of SaaS platforms and eCommerce platforms.
Security First Culture: Where applicable, transformed and promoted culture across the enterprise to include information security considerations and risk-based approach in all business and digital processes.
Customer Identity and Access Management (CIAM): Led security enhancements of secure access methods for millions of website users.
Managed Detection and Response MDR: Led deployment of foremost Managed Detection and Response solution with 1 minute to detect, 10 minutes to triage and 60 minutes to eject adversary.
Governance and compliance: Enacted charter and chair Security Steering Committee for efficient and better governance and led the enterprise to successfully achieve PCI-DSS certification.
Cloud Security: Led cloud infrastructure security enhancements including secure cloud configurations; Containers, Kubernetes & microservices security; Enhanced DevSecOps pipelines.
Threat management: Implemented best-in-class vulnerability management, threat prevention and threat response program across the global enterprise to protect against ransomware, malware, and phishing.
Security management: Built a world-class cyber security program, supported by a robust set of policies and procedures, training, team development for the enterprise and eCommerce platforms.
Risk Management: Enhanced security risk management, maturity and manage resiliency using NIST-CSF.
Endpoint Detection and Response EDR: To prevent malware and ransomware attacks, led deployment of the most advanced available solution for endpoint detection solution.
Network Detection and Response NDR: To protect company networks, led enterprise global deployment of one of the most advanced network security solutions to protect against malicious network activities using artificial intelligence and machine learning.
Application Security (DevSecOps): To protect websites, enhanced CI/CD pipeline security by deploying world’s leading solution for secure coding.
Data Loss Prevention (DLP): To prevent insider threats, led global deployment of enterprise data loss prevention for both, data in motion and data at rest.
Information Security Organization: Established information security functions and team to support security, governance, risk, and compliance.
Endpoint Detection and Response EDR: To prevent malware and ransomware attacks, led deployment of the most advanced available solution for endpoint detection solution.
Network Detection and Response NDR: To protect company networks, led enterprise global deployment of one of the most advanced network security solutions to protect against malicious network activities using artificial intelligence and machine learning.
Application Security (DevSecOps): To protect websites, enhanced CI/CD pipeline security by deploying world’s leading solution for secure coding.
Data Loss Prevention (DLP): To prevent insider threats, led global deployment of enterprise data loss prevention for both, data in motion and data at rest.
Information Security Organization: Established information security functions and team to support security, governance, risk and compliance.
Security Architecture ChristusHealth :
COD July 2012 – 01/2020
Technical Project lead on various projects while engaging with the Project Manager to ensure that all tasks and deliverables are completed within the given timeline.
Project Manager to ensure that all tasks and deliverables are completed within the given timeline Provided overall direction, guidance, and definition of IT architecture
support the business mission Lead implementation of Lync/Skype, Windows 2008 and 2012 Server and Exchange 2008/2013 migrations and upgrades Conducted problem-solving with AD, BigFix, Exchange and VMWare systems Architecture of the AD, Exchange, Lync/Skype and VMWare environments DNS, DHCP and IPAM Administration using Infoblox
Implemented BigFix Lifecycle, Inventory and Compliance Responsible for the conceptual completeness, BigFix Architecture, design deployment solutions Implemented Data Forensics for
Christus health and implemented training to help mitigate against theft.
PCI DSS Enineer level 1 :
Ticketsoft a Mark Cuban Co. 01/2004 – 01/2012
Windows 2008/2003/2000 Server Administration Windows 2008/2003/2000 Server
Administration Managed the Reserve System including 1500 servers BigFix Enterprise
Administration and RSA key fob maintenance with RSA EMC VMware – Maintenance, upgrades,
and supported the ESX clustered hosts within the Virtual Center Worked with Trust wave on all
IDS, IVS,IPS system installations and upgrades Project Manager for key projects, upgrades, pen
testing, as well as internal and external audits Maintained Change Control in Remedy for all
production changes along with writing company policies and guidelines Assisted in developing.
procedures and cross-training to operations staff Led business critical information initiatives for
large financial institutions involving encryption of customer data to ensure compliance with
change in federal laws Developed administration processes that ensured compliance with IT policies.
Contact this candidate