Created: March 10, 2025 | Modified: March 31, 2025
Rick Henderson, M.Ed, BSc. Computing/Computer Science
- Visit my profile on LinkedIn
- Hidden Security on Substack - Blog: My notes and articles on cybersecurity.
- Unstructured stream-of-thought notes on my research and practice in cybersecurity
- My Python Playground - A bunch of Python code I'm writing while trying to get a job as a Security Engineer.
- Application Security - Sometimes application security, sometimes red teaming.
Thanks for taking the time to check my portfolio. If I have applied for a job with your company please let me know you stopped by.
Hi, I'm Rick.
I'm a information security expert looking for fulfilling roles in cybersecurity related to or including product security, malware analysis, threat intelligence, SOC analyst, or security consultant.
I've been diving into Hermes Agent and connected it up to Telegram. When I asked it to reframe my experience at BlackBerry through a lens of cyber threat intelligence (CTI), this is what it came up with:
Threat Intelligence & Adversary Emulation (BlackBerry)
- Global Threat Exposure & Adversary Emulation: Conducted offensive security operations against software protecting a global estate of 2M+ endpoints, simulating advanced malware and C2 frameworks (Sliver, Havoc, Metasploit) to validate detection efficacy against EDR/EPP agents. Translated tactical emulation results into actionable intelligence on adversary TTPs.
- Malware Research & IOC Enrichment: Led proactive research into emerging malware campaigns, aggregating and analyzing OSINT (media, threat reports, social media) to extract IOCs, PoCs, and adversary infrastructure. Produced and disseminated finished intelligence for internal stakeholders, focusing on malware trends and emerging vulnerabilities.
- Vulnerability Intelligence & Product Security: Analyzed vulnerability disclosures and applied CVSS scoring to contextualize risk across product lines. Collaborated with development and Threat Research teams to create detections, author product advisories, and provide technical guidance for mitigation—closing the loop between external threat data and internal product hardening.
- Validation & Purple Teaming: Evaluated penetration testing reports and third‑party findings to verify detection efficacy within the Cylance ecosystem. Communicated directly with MDR analysts and threat researchers to refine detection logic and improve response playbooks.
Arctic Wolf, Waterloo On, Concierge Security Engineer
- Delivered Arctic Wolf network and endpoint security solutions directly to customers, including security event investigation and log source validation.
- Utilized security tooling (Kibana and internal platforms) to identify threats and ensure environmental integrity.
- Educated customers in risk and vulnerability management, providing actionable remediation recommendations to mature their security posture.
- Maintained regular client sessions in accordance with SLAs, ensuring all technical and strategic concerns were evaluated and addressed.
- Conducted in-depth Security Posture Reviews and delivered targeted recommendations to reduce risk exposure within customer environments.
- Built and sustained strong client relationships, developing and executing plans to drive security maturity and long-term program growth.
My most recent position was as a Security Response Analyst II in the Product Security Incident Reponse Team (PSIRT) at BlackBerry.
My position there ended with the sale of Cylance endpoint security assets to Arctic Wolf.
My primary duties included writing detections for CylanceOPTICS, responding to enquries about new and emerging threats and if they can be stopped by CylancePROTECT, as well as vulnerabilty management for all Cylance software products. My work included binary scanning for static analysis, and determining if BlackBerry products were susceptible to reported vulnerabilities. This included a large number of open source libraries as well as BlackBerry proprietary code.
Secured 2M+ endpoints world-wide across governments, banks, and other institutions. Product Security & Threat Intel, Malware Analysis.
I have investigated and written detections for Jupyter, BlackBasta loaders, Spyboy Terminator, Emotet, GootLoader, WhisperGate, HermeticWiper and many other malware samples protecting more than 2 million endpoints world-wide.
I used C2 frameworks such as Mythic and Sliver for penetration testing and evaluating the effectiveness of endpoint detection and response software.
I have experience with threat research, staying up-to-date on new techniques, analyzing malware and maldocs to create detections, as well as scripting, coding in Python, C#, C/C++, and developing and testing detections.
On a daily basis I was writing Python scripts, reading malware write-ups, de-obfuscating malicious scripts in PowerShell, JavaScript, and Visual Basic. I would store scripts in Gitlab and search Github for malware and detections.
If you are interested in my cybersecurity work, you can also look at my repo of real-world cybersecurity information.
I also taught courses on computer concepts and applications and VBA Programming in Excel at Wilfrid Laurier University for over 20 years.
Note: You won't find a lot of activity outside of commits to my repos because I don't generally write software and when I do, I usually just put finished pieces directly into Github. That will be changing as I write more detection rules and other scripts to add to my portfolio.