Nicholas Bonds

> summary

Incident response lead with 10+ years securing federal and financial-sector environments, including the Departments of State, Homeland Security, Justice, and HUD. I hunt threats, engineer SIEM, and turn NIST RMF requirements into working policy, backed by SOC, ISSO, and sysadmin experience.

impact

Took a site's risk score from F− (7,000 vulnerabilities) to A (fewer than 40)

reliability

Sustained 99% uptime as a system administrator

credentials

13 certifications, incl. CISSP, CASP+ & SecAI+

> skills

siem / edr

Splunk & Splunk ES · Microsoft Defender (KQL) · Symantec EDR

vuln management

Tenable Nessus · Qualys · ACAS

observability

Cisco AppDynamics · Wireshark

threat intel / ir

Incident response · Forensics · IOC triage · Anomali · ThreatStream · GreyNoise · VirusTotal

ai

Wraithwatch · LM Studio (local LLMs) · AI security (CompTIA SecAI+)

governance

NIST 800-53 / RMF / CSF / 800-171 · A&A · System security plans · ITIL v4

systems / cloud

Windows Server · RHEL / Ubuntu / Kali · VMware · SCCM / SCOM · AWS · Azure

scripting

Python · PowerShell · Bash

> experience

1. DOS
   current

   Cybersecurity Engineer / Incident Response Lead

   Improvix Tech · U.S. Department of State

   • Lead incident response: triage critical alerts, investigate IOCs, and eradicate malware with Defender and Symantec EDR.
   • Run clustered Splunk: dashboards, correlation searches, and threat hunting with five intel feeds.
   • Author NIST 800-53 RMF policies and drive vulnerability remediation and SCCM patching.
2. DHS S&T

   ISSO / Security Engineer

   U.S. Department of Homeland Security · Science & Technology Directorate

   • Maintained system security plans and authorization (ATO) packages under NIST RMF.
   • Managed continuous monitoring, POA&Ms, and vulnerability remediation.
   • Advised engineering teams on security controls and compliance requirements.
3. DOJ · HUD

   SIEM Engineer

   U.S. Department of Justice · U.S. Department of Housing and Urban Development

   • Engineered SIEM log onboarding, parsing, correlation rules, and dashboards.
   • Built and tuned detection use cases aligned to federal security requirements.
   • Supported SOC analysts with investigations and maintained platform health.
4. FIDELITY

   SOC Engineer

   Fidelity National

   • Monitored, triaged, and escalated security alerts across enterprise systems.
   • Tuned detections and maintained security tooling to reduce noise.
   • Supported incident response and documented SOC runbooks.
5. NRL

   Information Systems Security Engineer

   ASRC Federal · Naval Research Laboratory

   • Led security control implementation, testing, and risk assessments for A&A.
   • Built Splunk monitoring: forwarders, search head clustering, apps, and ACAS integration.
   • Maintained in-house security tooling and system security plans.
6. ROTHWELL

   System Administrator

   Rothwell, Figg, Ernst & Manbeck, P.C.

   • Sustained 99% uptime across servers, network, and end-user systems.
   • Launched a firm-wide MDM program and phishing awareness campaigns.
   • Wrote disaster recovery SOPs and secured systems under RMF.
7. ICMA-RC

   Network Security Administrator (Contractor)

   ICMA Retirement Corporation

   • Lead administrator for a Windows 7 rollout to 3,000 users, with automated deployment workflows.
   • Provided Tier 3 support and deployed secure printing systems.

> certifications

• ISC² CISSP2020-01
• CompTIA SecAI+2026-09
• CompTIA CASP+2020-01
• CompTIA Security+2017-01
• Associate CISO2024-04
• Azure Administrator (AZ-104)2024-04
• AWS Solutions Architect – Associate2021-11
• Splunk Enterprise Security2023-05
• Splunk Enterprise Admin2021-06
• Splunk Core Power User2021-02
• DISA HBSS Admin ePO 5.92021-07
• DISA ACAS Supervisory Course2021-06
• ITIL v42020-06

> contact