GIAC Cloud Forensics Responder

GIAC Reverse Engineering Malware

Microsoft SC-200

GIAC Certified Forensic Analyst

Cyber security professional with nearly six years experience in incident response. Highly technical skill set which I've used during intrusion analysis on incidents ranging from ransomware, business email compromises, malware infections and cloud intrusions. 

I am a passionate learner who enjoys adapting to the challenges presented by cyber threat actors. When I'm not responding to incidents, my main area of focus and interest lies in researching methods in which threat actors can be analysed, detected and identified proactively within corporate environments.

For this role, my responsibilities involved:
  
Provided remote support for Windows and Mac OS X users.
  
Interacted with customers face to face, ensuring all information on the issues they were experiencing with their devices was captured when systems were booked in. Along with answering any questions they had.
  
Perform troubleshooting steps for hardware and software issues on Apple and Windows systems.
  
Implementing fixes for ongoing issues once troubleshooting steps had been carried out.
  
Administering Windows Active Directory for clients, including resetting user passwords and setting file and share permissions.

IT Support Apprentice

For this role, my responsibilities included:
Analysis and triaging for security alerts from various different sources (CrowdStrike, Network IDS sensors, AWS GuardDuty and custom SIEM rules) whilst prioritising each alert accordingly.
Collaborated with colleagues and system owners across the wider technology landscape at Pfizer to assist with triaging security alerts and log collection.
Performed scoping activities on incident tickets to understand the business impact which has taken place and how best to apply effective containment, remediation and countermeasure steps.
Gathered evidence to perform forensic analysis on compromised systems, malicious network traffic, log data and malware samples. This included endpoint activity logs, packet captures, application logs from Splunk and memory images from compromised systems.
Applied automated, static and dynamic capabilities to analyse malware samples discovered during incidents. Examples include Office documents, portable executables/DLLs, webshells and scripts.
Developed new security alert signatures to enhance Pfizer’s detection capabilities (Yara, Snort/Suricata, CrowdStrike & Splunk), focusing on MITRE ATT&CK TTPs and intelligence gathered by Pfizer’s threat intel team.
Took a leading role in security enhancement projects, which included purple team exercises to identify gaps in security practices & the development of cyber deception strategies to proactively identify active threat actors present in Pfizer’s network environment.
Participated in two different rotation exercises with the cyber threat hunting and security testing teams, in order to learn about new areas of cyber security within the wider business.
Used ImmersiveLabs platform to lead and conduct knowledge sharing sessions and address gaps in technical skill sets within the team.

Cyber Intrusion Analyst

For this role, my responsibilities included:
  
Performed high quality technical analysis on multiple intrusions, helping our clients to understand what happened during these incidents. Most recently for a retainer client in the healthcare sector who had suffered a ransomware incident with strong impact to business operations.
  
Produced high quality output in a variety of formats, including daily update slides and full technical investigation reports.
  
Worked closely with clients to understand their needs and build lasting relationships, which was achieved during an engineering project to help a client build a new in-house SIEM tool.
  
Contributed towards IR capability development. Including further improvements added to the IR cloud-based analysis platform in Google Cloud and proposition developments for IR work opportunities.
  
Managed client incident response retainer agreement with a client in the aviation sector, acting as the key point of contact for them and their client technical teams and being accountable for the technical excellence of our delivery.
  
Provided mentoring and oversight to the incident response practice to help new joiners, particularly graduates, grow and develop.
  
Assisted other PwC teams with cyber incident response subject matter expertise. Most recently for our crisis team in order to help them build and deliver a crisis tabletop exercise.
  
Worked alongside client teams to ensure risk was managed appropriately throughout the engagement lifecycle, which included following PwC’s processes for client and engagement acceptance.

Ciaran Timoney

#1 Video-Talent Marketplace

Ready to discover your perfect career?