OK so this is my last week at @Mandiant / @FireEye 😢
Here's the truth:
♥️ Joining Mandiant was the best decision of my career – the people & company have been SO good to me
🧠 Many of the brilliant minds in security are here & we have FUN every day
1/8
💻🔍 There is no better professional #infosec experience than responding to the intrusions that matter & defending at-scale alongside awesome people. If you have the chance to work here – .
🗓️ One year here is worth many more in experience. So here are some highlights:
2/8
☕️ Doing LRs & writing decoders during my first Mandiant breach response - with #APT17's HIKIT & also BLACKCOFFEE malware using technet for C2: fireeye.com/blog/threat-re…
💰 I was fortunate to lead the first IR for the group that would come to be known as #FIN7
3/8
If you work hard, sometimes you can outpace attackers & expose them to educate others. Here are a few IRs I did that we were allowed to share publicly:
🇷🇺 #APT29 🤯 #NoEasyBreach
🇻🇳 The IR that graduated #APT32 to the big stage: fireeye.com/blog/threat-re…
4/8
🇮🇷 Leading the breach response that promoted #APT33: fireeye.com/blog/threat-re…
📓 Many team efforts chasing bad guys around and reporting (via the blog) on their techniques: fireeye.com/blog/threat-re…
... and so many more that are NDA'ed forever, but I'll never forget! 🤫
5/8
A few years ago, I jumped at the chance to build out the #AdvancedPractices 🦅 front-line research team [follow many of them @ twitter.com/i/lists/104134…] and work alongside to FLARE's reverse engineers 🧙🏽♂️. The teams are brimming with talent, hard-work, & creative solutions.
6/8
I'm pleased to have helped shape authentic (& spicy) comms.
It's been an honor to have front-line friends from all across the company on #StateOfTheHack for the past ~2 years: On the show & in our blogs, we now go behind-the-scenes and show our work.
7/8
The goodbyes have been brutal. I'll miss the people immensely. But like, let's be honest, we are all still going to hang out on this free website Twitter dot com.
I'm super excited for what's next – and I hope the bad guys like their hiding spots because here I come! ➡️☁️😉
8/8
I'm going to take a few weeks "off" to spend time with my wife, COVID-19-homeschool my kids, pace anxiously around my home quarantine, get in better shape, & try to learn piano. By the end of the month, you can find me here:
Share this Scrolly Tale with your friends.
A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.