Podcast Producer & Host

• Nov 2022 - Present

Senior Security Researcher

• Sep 2019 - Present

I develop Zeek/Bro algorithms to solve difficult network security research problems at scale. I work in Corelight Labs, in Dr. Vern Paxson's team. I helped add DNS and ICMP C2 detection content to the Corelight product. I wrote "VPN Insights" in the Corelight product. I also wrote the "application identification" package in Corelight's product. I wrote zeek2es - a Python application to load Zeek logs into Elasticsearch: https://github.com/corelight/zeek2es I presented this at Elastic's community conference in 2022: https://www.youtube.com/watch?v=n1x4ShzhAo8&list=PL_mJOmq4zsHbigQnsjEcWed6N7Do5kss_&index=29 I developed the following protocol analyzers to open source Zeek: https://github.com/corelight/zeek-spicy-ipsec https://github.com/corelight/zeek-spicy-openvpn https://github.com/corelight/zeek-spicy-stun https://github.com/corelight/zeek-spicy-wireguard https://github.com/corelight/zeek-spicy-facefish https://github.com/corelight/zeek-spicy-ospf I wrote many more protocol analyzers that are closed source. Additional publications are in my LinkedIn publication section.

Threat Researcher and Big Data Software Engineer

• Jul 2016 - Sep 2019

Developed tools and systems for automated malware analysis at a very large scale. Software development ranges anywhere from large data streams, container technologies, messaging systems, caching systems, load balancers, databases, parsers, machine learning algorithms, and more. Included in this are threat researcher duties associated with malware defense. Blackberry purchased Cylance in early 2019. Developed tools and systems for automated malware analysis at a very large scale. Software development ranges anywhere from large data streams, container technologies, messaging systems, caching systems, load balancers, databases, parsers, machine learning algorithms, and more. Included in this are threat researcher duties associated with malware defense. Blackberry purchased Cylance in early 2019.

Lead Cybersecurity Engineer

• Feb 2014 - Jul 2016

I worked as a lead on incident response, proactive and reactive cybersecurity solutions, computer forensics, reverse engineering, malware analysis, training, etc. I developed several custom internal tools to automate and improve the incident response process, such as: - Customized XWays X-Tensions - Customized searching tools - Customized intelligence collection tools - Customized intelligence analysis tools - Customized forensic data collection tools - Customized forensic data analysis tools - Customized bootable environment for forensic and computer security purposes - Wrote open source WhoisGenie.NET making intelligent whois lookups simple: https://github.com/keithjjones/WhoisGenie.NET - Fixed and updated open source projects WhoisGenie.NET depends upon I obtained my PCI QSA and PCI PFI certifications at Fidelis. I continued to stay certified as a CISSP and CCE.

Director of Computer Forensics, Expert Witness Services, and Training Practices

• May 2013 - Feb 2014

I was hired to build a computer forensics and expert witness practice from scratch. In a very short amount of time I was able to bring on 10-12 consultants into the practice along with all of the software and hardware to build a successful service line. During this time, I also requested the responsibility of Kyrus training in which we provided very popular classes domestically and internationally. However, as these aspects were quickly growing, a sudden and unexpected switch in Kyrus's long term strategic direction did not leave room for any of these services at that time.

Owner and Senior Partner

• Jan 2007 - Apr 2013

Co-owner and a consultant in our company that provides e-discovery, digital forensics, expert witness, and cybercrime investigative services. Brought in the majority of clients for our top notch services. Worked with younger associates to educate them in the field of computer forensics. Co-owner and a consultant in our company that provides e-discovery, digital forensics, expert witness, and cybercrime investigative services. Brought in the majority of clients for our top notch services. Worked with younger associates to educate them in the field of computer forensics.

Director of Computer Forensics & Incident Response

• Aug 2004 - Dec 2006

Computer Forensics Manager

• 2000 - 2004

Senior Security Administrator

• Jun 2000 - Dec 2000

Software Development Program Manager

• Jun 1999 - Jun 2000

Systems/Network Administrator; Software Development

• Aug 1994 - Jun 1999