EXPERIENCE
Joe has over 20 years of experience in Information Security. He has worked in Incident Response, forensics, penetration testing, and security leadership as a CISO for a financial institution.
EDUCATION & CERTIFICATIONS
- GIAC Penetration Tester (GPEN)
- GIAC Strategic Planning, Policy, and Leadership (GSTRT)
- GIAC Certified Forensic Examiner (GCFE)
- GIAC Certified Incident Handler (GCIH)
- GIAC Security Leadership (GSLC)
- GIAC Cloud Penetration Tester (GCPN)
- GIAC Public Cloud Security (GPCS)
- GIAC Certified Web Application Penetration Tester (GWAPT)
- Certified Information Systems Security Professional (CISSP)
- CNSSI 4012 Senior Systems Manager
- CNSSI 4013 System Administrator in Information Systems Security
- CNSSI 4014 Information Systems Security Officer
- NSTISSI 4011 Information Systems Security Professional
- NSTISSI 4015 Systems Certifier
PROFESSIONAL AFFILIATIONS
- GIAC Advisory Board, ISC2
Joe also teaches leadership courses for the SANS Institute.
INDUSTRY CONTRIBUTIONS
Joe has presented at security conferences including Check Point CPX, Information Warfare Summit, and BSides.
PASSION FOR SECURITY
Joe’s passion for security started in Incident Response and forensics in the late ‘90s. Since then, he has developed a passion for offensive security, security leadership, and teaching others.
Featured Blogs And Resources
Discover the blogs, analysis, webinars, and podcasts by this team member.
Basic Authentication Versus CSRF
I was recently involved in an engagement where access was controlled by Basic Authentication. One (1) of the findings I discovered was a Cross-Site Request…
Introducing CoWitness: Enhancing Web Application Testing With External Service Interaction
As a web application tester, I encounter a recurring challenge in my work: receiving incomplete responses from Burp Collaborator during DNS and HTTP response…
BEC Basics: Your First Step to Thwarting Email Scams
Attackers never stop evolving their business email compromise (BEC) tactics, leveraging phishing, credential harvesting, and email spoofing to infiltrate…
Actionable Purple Team Simulation Online Training (November 7-8)
Learn how to create specific detections to identify early Indicators of Compromise (IOCs) in our online course. Designed for those looking to improve their…
Ask Me Anything: Advanced Cloud Pen Testing Scenarios
Cloud Penetration Tests are a critical component of cloud security, but integrating other testing methods can take the assessment to the next level. Adding…
Offensively Groovy
On a recent red team engagement, I was able to compromise the Jenkins admin user via retrieving the necessary components and decrypting credentials.xml. From…
Security Noise - Episode 7.4
Who's On My Network?
Spec-tac-ula Deserialization: Deploying Specula with .NET
Earlier this year, I gave a talk at Steelcon on .NET deserialization and how it can be used for Red Team ops. That talk focused on the theory of .NET…
Calculating Business Impact
In today’s digital landscape, gaining a deep understanding of how cybersecurity threats can affect business-critical systems is crucial for maintaining…
Let’s Clone a Cloner - Part 2: You Have No Power Here
Previously on Let's Clone a Cloner, I needed a long-range RFID badge cloner. There are many walkthroughs out there on how to build a cloner that are fantastic,…
Empower your business through better security design.
Talk directly with our experienced advisory consultants to learn how we can help.
