Hunter Storm | Wells Fargo | SOC Site Lead

Wells Fargo | Security Operations Center Security Monitoring Team (SOC SMT) | Site Lead Intrusion Detection Systems (SOC IDS) | Black Ops Team Member | Information Security Engineer (ISE) | Subject Matter Expert (SME) | Designated Member, Wells Fargo Leadership Succession Plan (2006 – 2007)

Wells Fargo | Company Overview

Wells Fargo & Company is one of the largest multinational financial services firms in the world and a cornerstone of the U.S. banking system. Headquartered in San Francisco, it ranks within the Fortune 50 and is consistently among the “Big Four” banks in the United States by total assets. With operations in more than 30 countries and tens of millions of customers worldwide, Wells Fargo plays a critical role in consumer banking, commercial lending, and capital markets, maintaining a global presence while remaining deeply embedded in the American financial landscape.

Professional Experience

Hunter Storm | Security Operations Center Security Monitoring Team (SOC SMT) | Site Lead Intrusion Detection Systems (SOC IDS) | Black Ops Team Member | Information Security Engineer (ISE) | Subject Matter Expert (SME) | Designated Member, Wells Fargo Leadership Succession Plan

QUALIFICATIONS

Highly skilled information security professional with excellent soft skills and extensive hands-on technical background. Resourceful and versatile; broad range of hands-on experience at multinational financial services corporation, Wells Fargo, including:

Architect’s Forum, Policy Taskforce, Enterprise Personally Identifiable Information (PII) Working Group, Wireless Security Working Group
Architecture / Strategic Planning and Execution
ArcSight / Remedy / RSA Archer Policy Management / Sun LDRPS
Business Continuity Planning (BCP) / Disaster Recovery (DR) / SEMP / Sun LDRPS
Change Management / Process Management / Process Improvement / ITIL / Remedy
Compliance and Governance: PCI, FFIEC, SOX (Sarbanes-Oxley), ISO/IEC 27002, COSO/COBIT, HIPAA, NIST, SB 1386
Contracts / Legal / RFI / RFP / SOW / MSA
Information Security / Security Assurance / Audit
IPS (intrusion prevention) / IDS (intrusion detection) / SIEM (Security Information and Event Management) / SIM / SEM
IT (Information Technology) / Operations / Enterprise Migrations / Systems Administration
Leadership and Management
Policy / RSA Archer Policy Management
Privacy
Project Management
Speaking / Presentation / Entertainment
Records Management
Security Planning / Risk Assessment / Risk Management / Risk Mitigation
Team Building / Mentoring / Coaching / Training and Development
Technical Writing
Vendor management

PROFESSIONAL EXPERIENCE

Monitored and supported host, network, and wireless IDS (Intrusion Detection Systems) 24×7 via 3 separate technologies, as well as a Security Event Information Management (SEIM) product. Participated in incident response via Enterprise emergency conference bridge calls. Administered and maintained team BCP (Business Continuity Plan) using Living Disaster Recovery Planning Systems (LDRPS). Consulted and collaborated with multiple business units on security issues; led meetings with multiple lines of business (LOBs), including management, engineers, architects, project managers. Actively participated in formal audits; prepared supporting documentation and response documents.

Designated member of Wells Fargo’s formal leadership succession plan.
Drove organizational change by creating model to merge the three separate IDS teams into one, creating new team member roles and responsibilities, and obtaining management buy-in for plan to merge to single team and on-call rotation. Updated backend systems to route and streamline workflow in support of merged team. Hosted team cross-training sessions and created documentation to support merged roles. Created project plan of over 100 team process improvements to streamline our environment.
Spearheaded departmental redesign by integrating Host-based Intrusion Detection (HIDS) with Network Intrusion Detection (NIDS) and Wireless Intrusion Detection (WIDS) teams, fostering cross-functional expertise and improved threat coverage.
Led cross-training initiatives across detection platforms, enhancing team agility and incident response capabilities.
Initiated and created quick-start artifacts to help managers order correct IDs for new SMT members, as well as items for new team members to help them get up to speed quickly in their new roles. These included New Hire Checklist, New Team Member directory, SOC Buddy List, HIDS Favorites, Blackberry Manager rules (wrote documentation to accompany the manager rules. Also created Access database for SRT to update SOC Contact list in Outlook-importable format so contacts would automatically synchronize to Blackberries. Trained SRT contact on database and worked with her to customize it to SOC’s and her needs. Also worked with enterprise teams to request bridge line and additional specialized access for all of SOC.
Lead Engineer; created technical requirements and design for IDS (Intrusion Detection Systems) / IPS (Intrusion Prevention Systems). Wrote all project documentation, including risk management plan, project charter, and business requirements. Initiated RFI process with Sourcing to assess vendor product offerings; drove vendor selection process.
Participated in Architect’s Forum, Policy Taskforce, Personally Identifiable Information (PII) task force, Wireless Security Working Group, and the Enterprise Cryptography team projects.
Lead Engineer; created technical requirements VPN / Wireless Project: Worked with Network to combine project efforts and develop merged requirements. Initiated RFI process with Sourcing to assess vendor product offerings. Drove vendor selection process, as well as Architecture Project Initiation Assessment.
Drove HIDS rearchitecture by creating logical design, taking lead on HIDS capacity increase PTP (Project Tracking Portal) request, then facilitating through Architecture review, infrastructure build, and hardware finance. Administered hardware sizing; wrote and submitted HIDS Enterprise Capacity Management Plan (ECMP).
Mentored and provided leadership to 3 new SMT members in Chandler. Arranged systems access as well as badging. Helped them get up to speed quickly on Wells Fargo, SOC, and SMT policies and processes by demonstrating processes; directing them to the manuals, policies, and resources they needed to review; and showing them where and to obtain supplies and equipment.
Troubleshot and resolved permissions, jobs, and backups on RealSecure SQL Server databases: to resolve OS monitoring pages related to insufficient drive space. Trained other team members on database configurations to prevent future knowledge gaps. Worked with IBM / ISS to resolve Event Collector issues related to ODBC permissions.
Reverse-engineered HIDS Activity Report Database; discovered and remediated AD authentication issues. Trained team members on database structures and updates.
Transitioned NDM Secure+ documentation to new enterprise NDM team. Hosted several calls where I walked the team through the product and its configuration. Provided package design for mass distribution, as well as example scripts for automatic configuration. Gave occasional help to NDM Support and Cryptography team in troubleshooting difficult NDM and Secure+ issues on Windows servers.
Submitted 2 Best Practices ideas, including PR idea for Learning and Development with suggestions on how to improve Security’s image, and 2) LDRPS / BCP process to confirm permissions (e.g., internal ticketing, Remedy, and Exchange) during plan verification.
Installed first production ArcSight SmartAgent on all the HIDS servers. Wrote and posted installation documentation. Trained HIDS team on installation.
Initiated and created the first HIDS ArcSight automated report to ACT to help enforce unauthorized administrator account usage.
Worked with the product owners to obtain access to other systems (e.g., Enterprise Event Archiver) that would speed SMT’s incident investigation.
Wrote proposal to build the first SOC Dashboard application and website. Discovered that the ArcSight project was already in progress; so, contributed to design instead. Facilitated ArcSight team Architecture review by setting up discussions with assigned architects, which resulted in defusing a volatile situation, as well in forging new relationships between departments
Redesigned and administered SOC OU; created global groups and privileged IDs for Host Intrusion Detection and other SOC teams. Redesigned and updated Active Directory Organizational Unit (OU) re-ACL’d to correct permission set. ACL’d new administration group onto IDS servers.
Wrote proposal to rearchitect Active Directory logical design. Wrote and diagrammed; presented to SOC management and team leads, as well as to Cryptography and Enterprise Infrastructure teams.

AWARDS, MEMBERSHIPS, and CERTIFICATIONS

AZSPF (Arizona Security Practitioners Forum), currently known as Southwest Cybersec Forum)
ACSA (ArcSight Certified Security Analyst)
CompTIA Network+ Certified Network Technician
Information Systems Audit and Control Association (ISACA)
ITT Technical Institute Advisory Committee for the School of Information Technology
Marquis Who’s Who in America
Marquis Who’s Who of American Women
MCP (Microsoft Certified Professional) on Windows 2000 Server and Windows 2000 Professional
Mensa
MOUS (Microsoft Office User Specialist) Master
Charles Schwab “Excellence in Service”
Wells Fargo Service Excellence: 35-time-winner
Wells Fargo Shared Success: 18-time winner
Wells Fargo On The Spot: 7-time winner
Wells Fargo Team Excellence: 3-time winner
Wells Fargo Brokerage Technology CIO Award of Excellence
Top Dawg
MicroAge / CompuCom Wells Fargo “Enterprise Associate of the Month”
MicroAge / CompuCom “Legends of Service” award

TECHNICAL SUMMARY

Server & Client Operating Systems: Windows 2000, Windows XP, Windows NT 4.0, Novell NetWare 4.11, Novell 3.12 and 3.11, OS/2 Warp 3, Unix BSD.

Protocols and Infrastructure Technologies: Active Directory, NDS, DNS and DDNS, DHCP, LDAP, SSL, TCP / IP, IPX / SPX, SMTP, POP, NNTP, Telnet, WINS.

Security Tools and Standards: Ethereal, Sniffer Pro, Black Ice, Visual Trace, Zone Alarm, Kane Security Analyst. Biometrics, ePASS, single signon, SET, 3DES, IPSec, ISAKMP, PGP.

Remote Administration and Authentication: Marimba Admin Tuner, Citrix, Remote Desktop, DameWare, Timbuktu, ADUC. RSA SecureID, smartcards SafeWord Softoken, Cisco VPN, Quintech Rova, RAS, RADIUS, PPTP.

Backup and Disaster Recovery: ArcServe Backup, Veritas Backup Exec, Cheyenne Backup.

Productivity and E-Mail: Microsoft Office, Project, Visio. Microsoft Exchange Server, Microsoft Outlook, Lotus Notes, Novell GroupWise.

Hardware: Servers, workstations, hubs, routers, NICs, modems, Liebert In-Line UPS, PDAs, Printers.

EDUCATION & TRAINING

BACHELOR OF ARTS (BA), COMMUNICATION

Arizona State University, Tempe, AZ (1999)

Honors College, Communication Honors Program, and Dean’s List.
Presented 2 papers on Intercultural Communication to Arizona Communication Association Conference.
Published in “The Journal of the Arizona Communication Association.”

ASSOCIATE OF ARTS (AA), GENERAL STUDIES

Scottsdale Community College, Scottsdale, AZ (1996)

Phi Theta Kappa, Public Relations Officer.
Honors Program, Graduate with High Distinction and President’s List.
Student Government, Senator of Communication and Humanities.

MANAGEMENT & LEADERSHIP

Communication Etiquette
Conducting an Effective Virtual Meeting
Effective Virtual Communication
EPM V2 Overview
Getting Results without Authority Simulation
Leadership Development for Technical Professionals
Superworker to Supervisor Building a Positive Workteam Environment Module 4
Superworker to Supervisor Resolving Team Problems Module 3
The Successful Facilitator SIMULATION
Working Together to Create an Inclusive Environment
Writing High-Impact Email

PLANNING

BCP (Business Continuity Planning)
Documenting Exercise and Maintenance tasks in LDRPS
ECMP (Enterprise Capacity Management
Foundation Plan
Living Disaster Recovery Planning System (LDRPS) Read/Write Version
SEMP BCP Drill (Corporate BCP & SOC-SMT)

TECHNOLOGY

AirDefense Advanced and Intro
ArcSight Certified Security Analyst for ArcSight Version 3.5
NFR application and N-Code
RealSecure
SOC-SMT Anti-Virus Monitoring
Wells Fargo Information Security Technology – Advanced
WFDC Support
WFDC Workstation Imaging

Skills

Enterprise Architecture · Vendor Management · Cloud Computing · Computer Security · Network Security · Cross-Cultural Communication Skills · Information Security · Science Communication · Information Technology · Cybersecurity · Innovation · Data Security · Risk Management · Operational Risk Management · IT Risk Management · Security · Interpersonal Communication · Enterprise Risk Management · Strategic Planning · Architecture · Active Directory · Risk Assessment · Creative Problem Solving · Disaster Recovery · Information Security Management · Emerging Technologies · Process Improvement · Thought Leadership

Clearances

Clearance-Equivalent Trust Designation – Trust-Based Unrestricted Access: Internal Trust Authority (Informal / Multi-Organizational)

Hunter Storm ™