Christopher Dressel

Senior Certified Splunk Administrator and Application Infrastructure Security Engineer with 10+ years of experience supporting enterprise applications, Splunk Enterprise, Splunk Cloud, SIEM/SOAR, and security monitoring environments. Experienced in application and platform troubleshooting, event resolution, root-cause analysis, after-action documentation, proactive performance monitoring, upgrades, deployments, data ingestion, backup/restore planning concepts, operational readiness, and cross-functional support. Hands-on experience with Splunk Enterprise Security, Splunk SOAR (Phantom), Splunk UBA/UEBA, Linux (including Red Hat/CentOS/Ubuntu), Windows, Docker-related environments, SPL, automation, RBAC, APIs, dashboards, alerts, correlation searches, and security-tool integrations.

Proven record leading 40+ upgrades, managing approximately 200 annual support tickets, supporting 300+ customers, and engineering SIEM content for a 20+ TB/day Splunk environment.

Senior Infrastructure Cybersecurity Engineer & Splunk Engineer - NETSCOUT - Allen, Texas

(2015-03 - 2025-07)

• Integrated and supported security data sources from firewalls, VPNs, IDS/IPS, EDR, and NAC platforms for comprehensive SIEM and network security monitoring
• Provided on-call global technical support to Sales, PLM, & C-Suite, preventing presentation outages and revenue impact
• Maintained application environments for PLM, Sales, and C-Suite across NETSCOUT products and third-party integrations, including environments requiring network security controls
• Designed backup strategy to meet Maximum Tolerable Downtime (MTD) & Recovery Point Objective (RPO) data loss requirements for secure enterprise environments
• Upgraded, planned, and troubleshot NETSCOUT Business Analytics product in Docker-based and Linux environments to maintain production stability and enhance security engineering practices
• Provided enterprise application and platform support for Splunk-based SIEM and security monitoring environments, troubleshooting application issues, data ingestion problems, search failures, dashboard performance, correlation issues, and alerting problems
• Monitored overall Splunk health across indexers, search heads, and cluster management components, including resource utilization, failed searches, dashboards, and non-triggering alerts to proactively identify performance and reliability issues
• Engineered SIEM content for a large-scale Splunk deployment ingesting 20+ TB/day, supporting operational readiness, security monitoring, detection coverage, and reliable event processing
• Developed Splunk SOAR (Phantom) playbooks to automate incident response workflows, reducing manual triage and improving response consistency
• Managed Splunk UBA & UEBA behavioral models and tuning to improve detection accuracy and reduce false positives in user behavior alerts
• Applied security controls and compliance practices for Splunk in healthcare environments to align with HIPAA, NIST, and PCI-DSS requirements, and supported incident response and network security initiatives
• Translated security, infrastructure, and operational requirements—including CIM Normalization and Knowledge Object Governance—into effective Splunk dashboards, reports, alerts, and scheduled searches for enterprise customers and internal stakeholders
• Created and optimized SPL queries, Correlation Searches, alerts, reports, scheduled searches, dashboards, and analytics for application monitoring, log analysis, detection engineering, and automated reporting
• Worked with Universal Forwarders, Heavy Forwarders, and HTTP Event Collector (HEC) endpoints to integrate multiple data sources and maintain accurate, consistent log ingestion from network and security devices such as firewalls, IDS/IPS, VPNs, and EDR platforms
• Provided end-user support for RBAC users and roles, API keys, SPL queries, reports, and dashboards; partnered with Engineering on Splunk architecture and Splunk ES technology add-on issues
• Troubleshot duplicate logs, timestamp errors, Field Extraction integrity, data ingestion issues, search performance, dashboard performance, and correlation problems across SIEM and security monitoring environments
• Authored Ansible and Terraform configurations for Splunk deployments to standardize builds and accelerate environment provisioning, supporting cloud security initiatives
• Documented incidents, root-cause analysis findings, preventive actions, troubleshooting procedures, maintenance MOPs, and operational standards to improve knowledge management and repeatability
• Collaborated with application, infrastructure, security, engineering, and operations teams during upgrades, deployments, monitoring initiatives, and security-tool integrations (including firewalls, IDS/IPS, and DLP solutions)
• Analyzed server and Splunk performance/capacity data for 300+ customers to identify sizing issues, capacity constraints, detection gaps, and reliability improvements
• Diagnosed and resolved Splunk indexer query bottlenecks, restoring full search performance within hours
• Developed Terraform modules for reproducible Splunk cluster deployments, reducing manual provisioning steps
• Performed root-cause analysis on ingestion failures, documenting fixes that reduced repeat incidents for engineering
• Integrated Splunk SOAR playbooks with incident response runbooks to automate evidence collection, ticket updates, and security event correlation

Upgrade Lead - Tektronix Communications (acquired by NETSCOUT) - Plano, Texas

(2012-03 - 2015-03)

• Provided on-call technical support for major carriers (AT&T, Verizon, T-Mobile, Rogers, Telmex), resolving critical incidents to maintain service continuity & SLAs for North American customers, including supporting network security and incident response efforts
• Authored runbooks for on-call rotations that standardized incident handoffs and shortened analyst ramp-up, including procedures for SIEM and log analysis
• Led 40+ solution upgrades and coordinated cross-functional planning and execution for enterprise deployments, emphasizing operational continuity, monitoring, troubleshooting, and controlled production changes relevant to security engineering
• Managed approximately 200 annual support tickets for Tier 1/2 providers and enterprise customers, resolving platform and deployment issues, coordinating escalations, and supporting security incident response as needed
• Planned and executed upgrade activities within customer timelines; streamlined upgrade processes for more than 40 implementations to improve efficiency, minimize client downtime, and maintain compliance with security and network policies
• Authored maintenance MOPs supporting approved upgrade windows, controlled production changes, troubleshooting, and repeatable operational procedures including network and security controls
• Analyzed server performance and capacity data to proactively resolve sizing issues, improve system reliability, and support network security objectives
• Supported vulnerability management, asset discovery, and security architecture requirements during customer upgrades, contributing to cloud security and NAC best practices
• Produced knowledge-base articles and coached KCS Level 3 contributors to strengthen documentation, knowledge management, and incident response readiness

Product Verification Engineer - Genband (acq. CVAS Division Nortel Networks) - Plano, Texas

(2006-05 - 2011-01)

• Validated Carrier VoIP which includes installing, upgrading, backing up, restoring software, and stress testing
• Supported 300+ customer install base including Tier 1/2 Service Providers
• Conceptualized 20k+ in cost-saving by streamlining and instituting new processes
• Realized 15k/year in cost-saving by providing individualized procedures for testing
• Authored technical design, architecture documents, technical presentations, data representations, charts and reports
• Versed in publications tools Epic XML editor, Adobe FrameMaker, Adobe professional, Vasont CMS, EMC Documentum, & Remote Based CI/CD Applications
• Developed a product test plan during the beginning lifecycle with cross-functional team
• Trained in Agile testing methodology for product and solution verification
• Collaborated and worked independently to achieve project deadlines and milestones
• Supported configuration and customization of the systems to customers' specifications
• Trained customers, teammates, & vendors on usage and administration of a system

Bachelor of Science - Electrical Engineering, Communications Option - University of Louisiana at Lafayette

Diploma - Basic Electronics - Young Memorial Technical College