Mike Lewis

About Mike Lewis

I have experience leading AI Security, AI Automation, SOC, IR, Incident Management, Threat Detection, Threat Hunting, and Cyber DevSecOps, Detection Engineering, and Response Engineering Teams. With over a decade of experience in cyber security, I have a proven track record of delivering successful programs and projects, identifying and handling complex cyber incidents and events, and recommending network security improvements in accordance with industry best practices.I am passionate about leveraging automation, scripting, Artificial Intelligence and Machine Learning to optimize the security posture and performance of the organization. I have architected and launched multiple solutions and dozens of use cases, such as an automatic ransomware quarantine model, FULLY Automated Phishing Response, EDR, International Travel, and various other complex automations, which have resulted in significant time, risk, and cost savings. I also have extensive knowledge and skills in various security tools and technologies, such as Splunk ES, Palo Alto Cortex XSOAR, Google Chronicle, Tines, Crowdstrike, Tanium, Velociraptor, Azure Sentinel, Microsoft Defender Products, IBM QRadar, and Cisco Stealthwatch, among others. Additionally, I hold multiple information security and general IT certifications, such as CISSP, GIAC GSEC, GCIH, GSNA, GPYC, and CCNA - Security, and others.TECHNICAL PROFICIENCIESAI: LLMs, Agentic AI, RAG, vector databases, MCP tools, prompt engineering, and groundings, MLOpsPlatforms: Windows 7-11/Server 20••••22, Linux (Red Hat, Debian, Kali, CentOS, Parrot) Android, Microsoft AzureSecurity Technologies: Splunk ES, Palo Alto Cortex XSOAR, Splunk SOAR, Swimlane, Chronicle, Azure Sentinel, Microsoft Defender(s), Elasticsearch Logstash Kibana (ELK), Sourcefire/FirePower, Crowdstrike, Tanium EDR, Qualys, Nessus, Snort, Bro, Zeek, Security Onion, Corelight, Wireshark, RSA Analytics Netwitness, Viavi Observer, Active Directory, Group Policy, IDS, IPS, MetaSploit, File permissions, Encryption, RSA SecurID, SIEM, SOAR, ThreatGrid, Twinwave, VirusTotal, Burpsuite, Cisco Stealthwatch, OpenDNS/Cisco Umbrella, Akamai WAF, Attivo, Honeypots, HoneytokensLanguages: Python, KQL, Powershell, SQL, Bash/ShellMethodologies: Cyber Kill Chain, Diamond Model, VERIS, MITRE ATT & CK (Attack) Framework and PRE-ATT & CK Framework, MITRE Engage, NIST SP 800 Series, ISO Series, Cyber Deception, Agile, Cloud Computing, OWASP Top 10Intel: Open and Closed Source Intelligence Gathering, Tactical, Operational, Technical, and Strategic Cyber Intelligence.

Experience

1. Cyber Security Group Manager

   Truist

   Sep 2024 — Present · Raleigh, NC, US

   Led a multinational team of 60+ in AI Security and Automation Engineering, driving risk reduction through Agile methodologies. • Developed and implemented security measures for AI applications, advising executives on vulnerabilities. • Streamlined incident response processes with custom automation, resulting in an 87% decrease in manual email security alerts.

Education

• SANS Technology Institute

  Bachelor of Applied Cyber Security, Cyber/Electronic Operations and Warfare

• Nash Community College

  Associate of Science (A.S.), Network and System Administration/Administrator

  2016 — 2018