Skill UI

Designs and implements IEC 62443-3-2 security zones and conduits for OT networks, covering risk-based partitioning, SL-T assignment, industrial firewall microsegmentation, and validation through traffic analysis and penetration testing aligned with the Purdue Reference Model.

Deploy Arkime to capture, query, and analyze network sessions, download PCAPs, and flag beaconing, DNS tunneling, or TLS anomalies for proactive threat hunting.

Deploy Nozomi Networks Guardian sensors for passive OT network monitoring to gain asset visibility, protocol-aware anomaly detection, compliance tracking, and SOC/ServiceNow integration without disrupting industrial control systems.

Extracts actionable malware indicators—from PE hashes to network, registry, and behavioral artifacts—using static/dynamic analysis, YARA scanning, and STIX 2.1 formatting for threat sharing.

Use Wireshark, tshark, tcpdump and Python to analyze PCAP/PCAPNG files for forensic cases, rebuild conversations, recover transferred files, highlight suspicious traffic, and document data exfiltration or command-and-control indicators.

Automates tshark and pyshark analysis of PCAP files to surface protocol statistics, top talkers, suspicious flows, IOCs, and DNS tunneling insights for incident response.

Deploys Zeek as a passive network security monitor to collect, parse, and analyze protocol metadata so teams can detect threats, anomalies, and integrate findings with SIEM or forensic workflows.