Benjamin L. Tomhave, MS, CISSP
3100 Jessie Ct, Fairfax, VA 22030     falcon@secureconsulting.net     703-282-8600

Objective:

A leadership position in an organization emphasizing excellence and integrity with the desire to formalize, internalize, and refine information security management practices.

Areas of Expertise:

  • Information Security Management: A holistic, process-based approach to building a risk resilient enterprise through the development of comprehensive business solutions that position IT and information security as a business enabler. Includes information assurance, governance, compliance, secure infrastructure design, policy development and enforcement, disaster recovery, intrusion detection, network and system hardening, firewall design and implementation, IT audit and evaluation, and security assessment.  Over ten years of hands-on and consulting experience bringing security to organizations of all size and maturity.

  • Policy Framework Design and Development: The key to a successful information security program hinges on the ability of the enterprise to communicate requirements to personnel within a comprehensive risk management and governance framework. Over ten years of hands-on and consulting experience in helping businesses design and develop security policy frameworks.

  • Education, Training, and Awareness: One of the most cost-effective methods of addressing internal security concerns is through the deployment of education, training, and awareness programs. These programs may cover regulatory requirements, good computing practices, or even technical security topics. More than ten years of hands-on and consulting experience in designing, developing, and delivering security, IT, and consulting skills training programs.

  • Secure Business Solutions: Significant experience bridging the gap between business and technology, serving to mitigate and translate through various circumstances.  Experience working with all levels of an organization, providing the vital communication link between business decision-makers and technology implementers.

Work Experience:

Security Consultant, BT Professional Services (BT INS, Inc.), Northern Virginia
September 2007 to present

Led and participated in information security consulting engagements covering the full spectrum of information security, information security management, business consulting, information assurance, and governance. Developed and delivered internal training programs on the topic of information security. Provided sales assistance for security-related engagements.

Introduced new technologies, both internally and to clients, including NetWitness, Cloakware, Cyber-Ark, Veracode, and Sentrigo. Worked actively to find new solutions to old and new problems that could provide a cost-effective alternative to poorly scalable manual and ad hoc approaches.

Conducted internal training in information security fundamentals and around services offered, including Ethical Hacking and the TrustCheck assessment tool. Also developed training on consulting skills.

Sr. Technical Security Engineer, AOL, LLC, Dulles, VA
September 2005 through September 2007
Technical Security Engineer, AOL, LLC, Reston, VA
December 2003 through August 2005

Performed in a leadership or supporting role within the following areas:
  • Information Security Management (team lead)
    • Managed and performed information assurance activities.
    • Managed up to ten (10) consultants performing information assurance activities.
    • Led the development of assessment methodology, report templates and boilerplates.
    • Assisted with Sarbanes-Oxley audit, compliance and governance, including gaining familiarity and experience with COSO and CoBIT.
    • Researched and evaluated methodologies and models including OCTAVE, IA-CMM, OSSTMM, SSE-CMM and SIPES, to better assistance with overall assurance initiatives.
    • Led inter-departmental cooperation in securing system build images based on approved security standards and assessed through a formal systems vulnerability assessment process.
    • Assisted with development of enterprise-wide information security policies, standards and baselines.
    • Initiated the understanding and incorporation of Information Security Management System concepts and practices based on ISO 17799 and BS 7799-2.
  • Training (team lead)
    • Led and assisted in development of presentation and materials for technical security training.
    • Coordinated and attended training for Cybertrust TruCommand Intellishield portal.
    • Organized and attended training from BSi on implementing ISO 17799.
  • Incident Response Management (contributor)
    • Participated in Incident Response on-call rotation.
    • Maintained Security Points of Contact list for internal and external divisions, and coordinated communication with Security Points of Contact as part of Incident Response Management program.
  • Administration (contributor)
    • Managed access for TruSecure TruCommand portal.
    • Developed documentation to support new hire transition and integration, as well as, an informal new hire mentor program.
Instructor, IP3 Inc., Saginaw, MI
May 2006 through March 2007

 Provided lecture-based and hands-on instruction to post-secondary students in the following courses:
  • CISSP boot camp: Delivered instruction over four (4) CISSP modules in conjunction with other instructors. (October 2006)
  • Online CISSP training: Delivered instruction over one (1) CISSP module online over three (3) days. (March 2007)
  • Podcast: Making Sense of Models, Frameworks, and Methodologies: Delivered a presentation based on Masters Thesis research into information security models, frameworks, and methodologies. (July 2006)
Adjunct Professor, ITT Technical Institute, Springfield, VA
September 2006 through November 2006 (resigned due to external workload)

 Provided lecture-based and hands-on instruction to post-secondary students in the following courses:
  • IT250 Linux Operating System: A hands-on course providing detailed instruction into the basics of Linux system administration, including use of Apache.
WAN/Security Engineer, i_TECH Corporation, a subsidiary of First Interstate Bancsystem, Billings, MT
August 2003 through November 2003 (position eliminated)

 Lead security engineer and member of the Network Services team. Responsible for all aspects of operational security within supported systems, including OS and router hardening, perimeter and internal firewalls, AV maintenance, etc. Developed comprehensive secure infrastructure solution to overhaul and realign existing infrastructure. Solution included new firewalls (NetScreen and Cisco PIX), upgraded AV infrastructure (Trend Micro), VPN capabilities (NetScreen, Cisco and Secure Computing), outbound web proxy (BlueCoat) and additional network management capabilities (CiscoWorks VMS, NetScreen GlobalPRO).
Senior Systems Engineer, Sofast Communications, Great Falls, MT
October 2001 through April 2002 (contract), January 2003 through August 2003

 Lead systems administrator and secondary network administrator for national Internet Services Provider. Responsibilities included supporting dial-up, broadband and DSL customers for connectivity, email and web hosting. Also provided systems administration to systems used for web hosting and portal services. Projects included designing, building, implementing and maintaining cluster and high-availability systems, implementing anti-virus and spam-filtering measures, implementing host-based security, designing and implementing a secure network architecture, designing and implementing a backup solution, designing and implementing security policies and procedures, and designing and implementing a productized broadband management solution.

Managed systems included RedHat Linux, Mandrake Linux, Cobalt Linux and Windows 2000. Applications and tools used included Apache, IIS, Qmail, Vpopmail, ezmlm-idx, SquirrelMail, SqWebMail, IC-RADIUS, ISC DHCP, FreeRADIUS, Cistron RADIUS, MySQL, PHP, PERL, Optigold ISP, BIND, djbdns, MyDNS, Postfix, and Legato Networker, to name a few. Also provided Level 2 and 3 support for wireless broadband delivery network, Cisco switches and routers, and Extreme Summit 48i switches, including general LAN/WAN configuration, hardware load balancing and VLAN design and implementation.

Network Security Lab Analyst, ICSA Labs, a division of TruSecure Corp., Mechanicsburg, PA
July 8, 2002 to December 19, 2002 (moved)

 Conducted comprehensive security testing and certification of firewall products. Worked with vendors to coordinate resolution of issues. Testing involved use of common penetration assessment tools, including Nessus, CyberCop, Nmap, hping, nemesis and tcpdump, among others. Testing was conducted in a process-oriented, scientific environment aimed at applying a consistent measure to a variety of firewall products, ranging from consumer appliances to enterprise solutions.
Information Security Analyst 4, Secure Access Implementation, Wells Fargo Services Corporation, Minneapolis, MN
November 27, 2000 to August 31, 2001 (moved)

 Provided technical project management to a team of 30+ engineers throughout the country. Responsibilities included design review, workflow management, special project leadership, and point-of-contact for regular work requests. Team was responsible for managing 500-600 firewall, web and application servers, based on Sun Solaris, Compaq Tru64, and Windows NT.
Senior Security Consultant, BORN Information Services, Minnetonka, MN
January 31, 2000 through October 12, 2000 (layoff)

 Provided clients in various industries with technical professional services. Areas of service included networking, information security and server administration. Built a security consulting practice from the ground up, including developing a unique methodology for deploying information security within a business. Provided pre-sales support to account executives as well as assisting with lead identification and development. Presented at regional security conference on the topic of strategic security. At clients, assisted in development of Windows 2000 early adoption security policies, conducted critical design review of existing infrastructure and recommendations for improvements, and conducted security assessment of key servers with recommendations for remediation of vulnerabilities.
Senior Security Consultant, Ernst & Young LLP, Minneapolis, MN
May 31, 1999 through January 28, 2000

 Participated in and led Information Technology audits, including documenting and providing expert analysis of system and network security. Presented audit and security assessment findings and provided business justification for recommended changes. Involved with both standard IT audits and SAS-70 Type I and Type II reviews. Notable assignments include: National Computer Systems, Fortis Inc.,Target Corp., American Express Financial Advisors.
Associate Network Systems Engineer, International Network Services, Chicago, IL and Minneapolis, MN
July 13, 1998 through May 28, 1999

 Provided network professional services to various clients, including Target Corporation and IBM Global Services. Conducted troubleshooting, network design and implementation, and fulfilled numerous other network administration functions. Assisted in the operation and maintenance of a Network Operation Center for a major insurance provider. Served as point of contact during office move. Facilitated design changes and trouble requests associated with move to new office location. Designed and implemented networked classroom, including installation of standardized cabling, Ethernet hubs, Windows NT 4.0SP3 server with DHCP, and Cisco PIX firewall.

Education, Certifications, and Professional Organizations:

  • Master of Science (December 2006), The George Washington University, Washington, DC
    Engineering Management with a Concentration in Information Security Management
  • Bachelor of Arts (May 1998), Luther College, Decorah, IA
    Major: Computer Science     Minor: Mathematics
  • Certified Information Systems Security Professional (CISSP) #46697
  • NSA INFOSEC Assessment Methodology (IAM) Training/Certification: Completed 06/14/06
  • NSA INFOSEC Evaluation Methodology (IEM) Training/Certification: Completed 06/16/06
  • NSTISSI 4011, 4012, 4013, and 4015 Certified
  • IEEE and Computer Society, Member (since 01/08)
  • Information Systems Security Association (ISSA), Member (since 02/08)
  • American Bar Association Information Security Committee (ABA ISC), Associate member (since 02/08)
  • InfraGard, DC Field Office, Current Member (since 07/04), IT Sector Chief (10/06-08/07)
  • Attended RSA Conference 2008
  • ISACA, National Capitol Chapter, Former Member (July 2004 – December 2006)
  • Attended ISACA 2005, 2006 Information Security Management Conferences
  • “Facilitative Leadership” by Interaction Associates: Completed 04/18/07
  • BSi ISO 17799 Implementation training: Completed 03/11/05
  • “Managing Conflict” by Ridge Associates: Completed 03/30/05
  • SANS Track 8: System Forensics, Investigations, and Response: Completed 04/07/04
  • Introduction to Cisco Router Configuration (1997, Global Knowledge)

Internships and Other Work Experience:

  • Intern, Customer Relationship Management, Andersen Consulting (Accenture), Minneapolis, MN
    June 2, 1997 through August 29, 1997
  • Co-op, Science and Engineering Research Semester, Argonne National Laboratory, Argonne, IL
    January 7, 1997 through May 23, 1997
  • Intern, Office Systems Support, National Computer Systems, Iowa City, IA
    June 1, 1996 through August 16, 1996
  • Freelance Consultant, Various Clients and Locations
    March 1996 through May 1998
  • UNIX Administrator/LAN and Desktop Support Specialist, Luther College, Decorah, IA
    November 1994 through March 1996