Title: Company CV
Subject: Template for creation of a company employee CV
Author: lambournek
Last saved by: Pintom
Company: Echelon Consulting Ltd

Curriculum Vitae

Name: | Marcus Pinto
Date of Birth: | 05.09.78
Degree: | BA + MSci Physics degree, Cambridge University
Security Clearance: | Security Check
Employment History
10/00 – Current | Echelon Consulting Limited | Consultant
08/99 – 09/99 | European Centre for Geophysics and Seismology | Website development & database design
10/96 – 07/00 | Sidney Sussex College, University of Cambridge | -

INTRODUCTION
I am currently employed as a security consultant for Echelon Consulting Limited. I have had a key role in each of Echelon’s penetration tests; my interest has been maintained by the continual developments in internet security and the creative nature of the work. 
As I am approaching the limits of the required technical expertise within my company I am seeking the opportunity to expand my technical ability in breadth and depth.
APPROACH
My approach to penetration testing is focussed on understanding the causes of vulnerabilities discovered through use of low-level hacking tools as opposed to reliance on automated tools. This was required to adapt to a variety of test scenarios, including application security and environments with no access to arbitrary tools.
In large-scale tests this approach must be modified, and has generally involved a mixture of automated tools followed by specific tests to reduce false positives.
PROFILE
I joined Echelon as a physics masters graduate from Cambridge University. Work undertaken is mainly technical IT security consultancy, in particular penetration testing. Internal responsibilities include penetration testing strategy, proposal and report template development, the assembly and maintenance of the test network and continuing research into the leading vulnerabilities on mailing lists and databases.
In addition to technical security, I have conducted several BS7799 assessments and worked on security policy development.
Significant peripheral skills are:
•	The ability to present findings in a clear, concise and articulate report; all penetration testing reports I have submitted to date (10/08/01) have led to repeat work.
•	An insight into security management within an organisation and policies and procedures (Codes of Connection, firewall policies, incident reporting) related to a penetration test.
•	Private research into the roles of applicable law such as the DPA, CMA, IPR and UK case history.
Summary of Technical Experience

Operating Systems Used | DOS v. 3-7, Linux, Windows 9.x / NT 4 / 2000.
Targets | The major firewalls (Firewall-1, Cisco PIX, Axcent Raptor), various web-servers (mainly IIS) and operating systems (NT 4, *nix, and Windows 2000)
Languages | Pascal, Fortran, Delphi, Access Basic, basic linux and windows scripting languages.
Tools | Nessus, ISS, nmap, ethereal, hping and other open-source penetration testing tools.
Project History

08/01

An Aviation Authority - Security Review of a Data Diode Installation
Review of security issues surrounding the client’s implementation of DINO (a data diode developed by DERA) covering transmission controls and Denial of Service.

07/01 - 08/01

Centrica – BS7799-based Systems Assessment
Part of a 3-man team performing Information Security Assessments against 9 major application systems to review current practices against BS ISO/IEC 17799-1: 2000 (E).

07/01

FSS (Forensic Science Services) – Technical Security Support
Provision of call-off security advice for firewall selection and configuration, as well as advice on system hardening.

07/01

A Provider of Broadband Interactive Products and Services - Penetration Test
Following the client’s recent installation of an online ordering service authenticating through the RSA Ace Agent on an IIS system, I was asked to conduct a penetration test to ensure:

•	Clients authenticated using their SecureID token could not access other client data;
•	The application could not be compromised by an unauthenticated user.

After 2 days, account administration privileges and client details were accessed. Several solutions were provided in the report, as well as solutions for further system hardening.

06/01

Part of the National Critical Infrastructure - Penetration Test
The client piloted an email/web to desktop solution on a network containing national critical information. The work involved leading a penetration test against the external points of access, points within the DMZ and various LANs on the internal network.

05/01

Digital Rum - BS7799 Information Security Audit
BS7799 Risk Assessment for a client dealing heavily in m-commerce and e-commerce. The client required reassurance that existing technical measures were being defined, formalised and managed appropriately. Recommendations were produced addressing the client's immediate situation and long-term requirements for BS7799 certification.

03/01

Network architecture / ongoing evaluation
Planning the construction and management of a heterogeneous NT/Linux network. This included identification of the required computers and their assembly from scratch, including a router based on the Linux operating system.

03/01

Institute of Chartered Accountants (ICA) – Security Policy
Information Security Policy development for a major accountancy firm.

02/01

A UK Aircraft Control Centre - Penetration Test
Penetration testing a VPN-1 link from Chicago to London and production of the report.

01/01-02/01

DERA – Windows 2000 Security Assessment
Testing the security of a Windows 2000 network. This involved system compromise and Denial of Service possible through use of the Windows Scripting Host, now native to the Win2k operating system.

01/01

A Provider of On-line Learning Services - Web-Server Penetration Test
Penetration Testing of a live web-server. Due to changes made to their public facing web server the client required Echelon to carry out further testing of their web-server to the same standard and specification as the tasking undertaken in September 2000.

11/00-12/00

A UK Aircraft Control Centre - Penetration Test
Leading a penetration test of a test network mirroring a control sub-system. This sub-system connects an Aviation Agency in the United States of America to a London Control Centre in the United Kingdom via a VPN connection and is used to pass radar information used in aircraft flight management. Testing involved evaluation against several attack scenarios and production of the final report.

11/00

Penetration Test for a Lloyds of London Insurance Underwriter/Re-insurer
Penetration Testing for a client, initially involving footprinting and scanning of a live webserver. Upon submission of the report this was extended to scanning two internal firewalls.

10/00 – Present

Echelon Consulting Limited
Technical Consultant within Echelon being trained in Security, Strategy and Safety Case Analysis.

08/99 – 09/99

European Centre for Geophysics and Seismology
Design and development of a website, as well as coding a database using MsAccess and Access Basic. This involved understanding of research tools and methods, and translation into English, aimed at a variety of skill levels.