Hogan, Andre

Profile view: experience

1. 2025 → to2026

   U.S. Navy

   Threat hunting and network analysis

   17 months

   Cybersecurity Analyst / Senior Network Analyst

   • Led hypothesis-driven threat hunting across Security Onion, Elastic, Zeek, Suricata and full packet capture, targeting adversary behavior, lateral movement and gaps in security controls.
   • Ran 14 TB of packet, flow and protocol data against 98 adversary TTPs mapped to MITRE ATT&CK and the Cyber Kill Chain, and cleared every network in scope.
   • Triaged more than 1,000 alerts a cycle and walked junior analysts through correlation and root-cause work. What came out of it went back into the detection logic.
   • Surfaced roughly 300 vulnerabilities per cycle, plus misconfigurations that only showed up in architecture and configuration review, then ranked the fixes by operational risk.
   • Pushed several vulnerabilities and one severe insecure-configuration practice straight to remediation after finding them mid-hunt across host and network telemetry.
   • Wrote and maintained Suricata, Sigma and YARA content. Sensor tuning against known TTPs widened ATT&CK coverage and cut false positives.
   • Built the work-role qualification pipeline and delivered 40 hours of operational training, qualifying three analysts across three roles.

2. 2023 → to2025

   U.S. Navy

   Leading network hunts

   16 months

   Cybersecurity Analyst / Network Hunt Lead

   • Lead network and protocol analyst on a deployed hunt: 35 indicators of compromise found and malicious activity confirmed, working alongside industry partners and other defensive teams. Every objective was met.
   • Escalated confirmed intrusions with characterized adversary TTPs, enriched IOCs and containment recommendations. The network owners validated and acted on all of them.
   • Senior analyst on intrusions across defended networks: traffic analysis, IOC detection and enrichment, adversary TTP characterization.
   • Ran vulnerability discovery, network mapping and enumeration across several environments, validating findings with the local defenders before handing them off.
   • Built and ran adversary-emulation scenarios in Kali and Metasploit so analysts had live activity to detect against instead of canned data.
   • Designed a full-scope detection range to work-role specification and directed a team through the build, shortening the qualification pipeline.
   • Trained 15 analysts on work-role requirements and tooling. Seven qualified, raising ready analytic capacity 50%.

3. 2019 → to2023

   U.S. Navy

   Host forensics & malware analysis

   48 months

   Cybersecurity Analyst / Host + Network Analyst

   • Found and mitigated network intrusions through hands-on traffic and protocol analysis. Qualified as both a host analyst and a network analyst.
   • Worked host compromise on Windows and Linux: event and application logs, known-good image comparison for altered binaries, rogue accounts and elevated permissions via Sysinternals, PowerShell and native tooling.
   • Triaged suspected malware in isolated FLARE VM and REMnux builds, using snapshot comparison to catch what actually changed. The indicators went into detection content and mission reporting.
   • Reverse engineered suspicious binaries: PE structure and imports in CFF Explorer, embedded artifacts with strings, stepped execution in x64dbg to work out functionality, persistence and command-and-control behavior.
   • Imaged hosts with FTK Imager, examined them in Autopsy, recovered memory-resident artifacts with Volatility, and caught log tampering by reconciling local logs against forwarded copies.
   • Stood up training range environments end to end, workstations, servers and the cabling behind them, taking training capacity up 400%.