Information Security Engineer

Red, Blue, Purple Team

Strengthening defenses with expertise in
Blue and Red Teaming.

Professional Summary

As an experienced Cyber Security professional with over 14+ years of expertise in the field, I have specialized in both manual and automated Penetration Testing of network and system infrastructure, Web Applications, and APIs, as well as implementing and managing IT security systems and solutions, developing and implementing Vulnerability Assessment programs, implementing Critical Security Controls, Risk Assessment, maintaining security standards, policies, and procedures. Strong professional background in designing, developing, and implementing security-related new technologies and services to enhance the organization's overall security posture. As well as developing and integrating Secure SDLC procedures and implementing security controls in the development life cycle, aligning security solutions with the organization's security policies and regulatory compliance requirements. My extensive work in designing and leading Security Operations Centers (SOC) across 21 countries has significantly contributed to global cybersecurity standards.

image

Certificates &
Achievements

Credly: Mikael Mirijanyan

Offensive Security Certified Professional

OSCP

by Offsec

Synack's 15for15 Recognition

15for15 Recognition

by Synack

Hack The Box ProLabs - Dante

Dante

by HackTheBox

Hack The Box ProLabs - OffShore

OffShore

by HackTheBox

API Penetration Testing

API Penetration Testing

by APIsec University

Cisco Certified Network Associate Security

CCNA Security

by Cisco

Cisco Certified Network Associate Routing & Switching

CCNA R&S

by Cisco

Professional
Experience

2020 - Present
Webb Fontaine Holding LLC, Yerevan, Armenia

Senior Information Security Engineer, Team Lead

Strategic Decision-Making and Leadership

  • Direct and manage security operations for a global enterprise spanning 21 countries, including the active management of security for 15 countries and the seamless handover of 6 data centers in a B2G (Business-to-Government) context.
  • Key decision-making on the design, implementation, and enhancement of security controls, aligning with organizational goals and regulatory requirements.
  • Manage and optimize budgets for security initiatives, ensuring cost-effective deployment of resources and technology.
  • Conduct hiring, mentoring, and performance evaluations for security team members, fostering professional growth and team cohesion.

Implementation and Management of Critical Security Controls

  • Establish and maintain comprehensive security controls for corporate infrastructure from scratch.
  • Design, implement, and supervise a Security Operations Center (SOC).
  • Monitor and enforce compliance with internal and external regulations, conduct compliance reports, and support audit processes.
  • Ensure robust edge and endpoint security for the organization.

Vulnerability Assessment and Penetration Testing

  • Develop and implement continuous vulnerability assessment programs to identify and mitigate vulnerabilities proactively.
  • Perform manual and automated penetration tests (black, gray, and white boxes) on network and system infrastructures, web applications, and APIs.
  • Conduct security assessments for web applications, infrastructure, and cloud environments to identify vulnerabilities and provide remediation recommendations.

Secure Software Development Life Cycle (Secure SDLC):

  • Design and integrate Secure SDLC procedures across all development phases.
  • Conduct threat modeling, code reviews, and security testing to ensure secure coding practices and alignment with organizational security policies and regulatory requirements.

Incident Response and Monitoring

  • Develop and maintain a thorough incident response plan to promptly detect, investigate, and resolve security incidents.
  • Measure SOC performance metrics and communicate the value of security operations to business leaders.
  • Optimize monitoring tools based on threat-hunting discoveries to enhance overall security posture.

Identity and Access Management

  • Secure client-server communications and implement robust identity and access management solutions.
  • Integrate single sign-on and multifactor authentication with existing directory services.

International Responsibilities

  • Manage security operations and infrastructure across 21 countries, ensuring compliance with organizational standards and international regulations.
  • Oversee the transition and operational handover of data centers in active and newly launched regions, upholding high-security standards and seamless integration.
2021 - Present
InfoSec LLC, Yerevan, Armenia

Senior Penetration Tester

  • Led penetration testing efforts across various infrastructures, web applications, Android applications, and vulnerability assessments, contributing to the development of innovative security technologies.
2024 - Present
Yogosha | Offensive Security Testing Platform

Security Researcher

  • Conduct application security research, identify vulnerabilities in web applications, and provide remediation strategies.
2020 - Present
HackerOne | Security Platform and Hacker Program

Bug Hunter

  • Identified vulnerabilities in high-profile systems and provided remediation strategies implemented by leading organizations.
2021 - 2024
Synack | Red Team

SRT Web Application Penetration Tester

  • Performed comprehensive penetration testing on web applications, uncovering high-risk vulnerabilities and developing strategic remediation solutions.
2020 - 2021
T Telecom LLC, Yerevan, Armenia

Senior Penetration Tester, Team Lead

  • Performed advanced Grey Box Penetration Testing on corporate local infrastructure and Black Box Penetration Testing on public networks.
  • Conducted penetration testing for corporate web applications.
  • Developed and integrated new security technologies and services.
  • Managed corporate two-factor authentication (2FA) VPN systems, including Google 2FA and Cisco AnyConnect.
  • Implemented centralized log server management.
  • Conducted NetFlow and log analysis for threat hunting, utilizing ELK stack and MITRE ATT&CK framework.
  • Managed corporate OSSEC Host-based Intrusion Detection System (HIDS) server.
2016 - 2021
CyberSec LLC, Yerevan, Armenia

Senior Penetration Tester, Team Lead

  • Led penetration testing efforts across various infrastructures, web applications, Android applications, and vulnerability assessments, contributing to the development of innovative security technologies.
2016 - 2020
Ucom LLC, Yerevan, Armenia

Senior Penetration Tester, Team Lead

  • Led a multidisciplinary team of 5-7 members, including penetration testers and blue team professionals, providing mentorship and fostering a culture of continuous improvement in cybersecurity practices.
  • Served as Acting CISO, overseeing the organization's information security strategy, and incident response plans, and ensuring compliance with industry standards and regulations.
  • Conducted advanced penetration testing on corporate networks and applications, significantly enhancing organizational security.
  • Developed and integrated innovative security technologies and services.
  • Managed corporate two-factor authentication (2FA) VPN systems, and centralized log servers, and performed in-depth log, data, and network flow analysis.
2013 - 2016
Ucom LLC, Yerevan, Armenia

Senior Networking and Systems Administrator

  • Managed critical DNS and VPN servers for corporate and customer-facing systems, including "Ucom LLC," "iCON Communication," and "Orange Armenia," ensuring secure and efficient operations across multiple locations.
  • Administered public Domain Name Servers, handling DNS design, authoritative and caching server management, zone distribution, secure transfers, forward and reverse zone creation, DNS security, TTL optimization, DNS views, exceptions, forwarding, and public/private domain management. Fulfilled customer requests for DNS host additions, modifications, and deletions.
  • Implement a Public Wi-Fi Hotspot with Captive Portal services for "HSBC Bank Armenia," "Ameria Bank Armenia," and "Ardshin Bank Armenia."
  • Managed subscriber authentication through Radius Servers.
2012 - 2013
Ucom LLC, Yerevan, Armenia

IPTV Technical System Administrator

  • Installation and maintenance of IPTV systems, ensuring consistent and secure service delivery to subscribers.
  • Processed and supervised subscriber service activation, modification, and termination, as well as troubleshooting related issues.
  • Collaborated with technical support and call center departments to resolve RT tickets.
  • Generated, updated, and maintained accurate programming and editorial information for assigned channels.
  • Sourced and edited relevant program information into the required format.
  • Managed on-air service issues related to EPG (Electronic Program Guide) data on assigned channels.
2012 - 2012
Ucom LLC, Yerevan, Armenia

Technical Support Senior Specialist, Team Lead

  • Managed a team of 20-25 technical support staff, overseeing daily operations, scheduling, and task delegation to ensure efficient service delivery.
  • Mentored and trained team members, fostering professional growth and enhancing overall team performance.
  • Managed the ticketing system, including tracking and responding to all RT tickets opened by technical support.
  • Processed and supervised new RT tickets in the technical support queue to ensure accuracy.
  • Prepared the technical support schedule.
  • Monitored, analyzed, and informed the appropriate department of any issues or problems related to subscriber services or the network.
  • Performed all responsibilities of the technical support specialist as needed.
2010 - 2012
Ucom LLC, Yerevan, Armenia

Technical Support Specialist

  • Troubleshoot and report issues related to subscriber services to the appropriate department.
  • Diagnosed and resolved hardware and software problems with subscribers' devices.
  • Addressed technical questions from current and potential subscribers.

Projects &
Consulting Services

The key projects and consulting engagements undertaken as an independent professional, focusing on delivering tailored solutions and driving impactful outcomes across diverse industries and clients.

2013 - Present
SOS Children's Villages Armenia, Yerevan, Armenia

Project Manager

  • Implementation and Configuration: Led the implementation and configuration of WAN networks, including Cisco ISR Routers, Switches, ASA Firewalls, and ISR 880 Routers with security licenses. Managed CUCME services, FXO, and GSM gateways with IVR, and configured both Cisco Hardware and Software IP Phones.
  • Installation, configuration, and maintenance of virtualization servers on ESXi and monitoring servers using Zabbix.
  • Penetration Testing: Conducted annual penetration tests to identify and address security vulnerabilities, ensuring the integrity and resilience of the network infrastructure.
  • Website Development: Developed and maintained websites, focusing on creating robust, user-friendly platforms to support organizational needs and enhance online presence.
  • Vulnerability Assessment: Performed comprehensive vulnerability assessments to identify and mitigate potential security threats, enhancing the overall security posture of the organization.
  • Developed and managed security awareness training programs for non-IT staff, creating engaging content and sessions to educate employees on best practices for safeguarding organizational data and preventing security breaches.
2015 - 2017
CH2MHILL Constructors Inc., Yerevan, Armenia

  • Managed Cisco Phone Server systems, including reconfiguring Cisco Unified Communications Manager Express (CUCME), handling analog and digital phone codecs, and configuring international call dial peers. Provided expert analysis and resolution for Cisco Phone Service-related incidents and codec issues, ensuring optimal system performance and reliability.
2015
Doubletree by Hilton Yerevan, Yerevan, Armenia

  • Collaborated with Global Convergence Inc. to oversee network and network security hardware installation and configuration, ensuring seamless integration and robust protection for the organization's infrastructure.
2015
Embassy of Kuwait Yerevan

  • Collaborated with TATA Communications to manage the installation and configuration of network hardware, ensuring efficient setup and reliable performance across the organization's infrastructure.
BetConstruct
Industry: Technology

  • Delivered comprehensive infrastructure and web application penetration testing, conducted security audits, and established a Security Operations Center (SOC) from the ground up to enhance overall security operations.
Buymie
Industry: E-commerce

  • Performed a gray box penetration test on their web application, identifying vulnerabilities and providing actionable recommendations to strengthen security measures.
LuckyCarrot
Industry: HR Technology

  • Performed a gray box penetration test on their web application, identifying vulnerabilities and providing actionable recommendations to strengthen security measures.
Paradox LLC
Industry: Technology

  • Performed a gray box penetration test on their web application, identifying vulnerabilities and providing actionable recommendations to strengthen security measures.
Shipex
Industry: Logistics

  • Performed a gray box penetration test on their web application, identifying vulnerabilities and providing actionable recommendations to strengthen security measures.
Redrays
Industry: SAP Security and Cyber Security

  • Served as a security advisor, conducting infrastructure and web application penetration testing to bolster the clients' cybersecurity framework.
SOS Children's Villages
Industry: Nonprofit

  • Conducted a detailed audit, designed and configured network architecture, and performed web application penetration testing. Also, assessed infrastructure vulnerabilities and conducted cloud infrastructure penetration testing to ensure robust security across the organization.
Swarovski Armenia
Industry: Retail

  • Provided network and system security administration services, ensuring the security and reliability of the company's IT infrastructure and protecting against potential threats.
Hyeconnect.org
Industry: Nonprofit

  • Conducted web application penetration test and a security audit, offering tailored recommendations to strengthen the security and integrity of their online platforms.
Grand Candy
Industry: Food Industry

  • Performed security assessments and audits for Armenia's largest confectionery manufacturer, focusing on enhancing cybersecurity measures within their operational infrastructure.
ITG LLC
Industry: Finance

  • Conducted specialized security services for Armenia's only SWIFT Service Bureau.
H1 First Channel
Industry: Telecommunications

  • Provided network administration services, ensuring the security and reliability of the company's IT infrastructure.

Contact Me