Open to opportunities

Kenneth Bailey

@kennethbailey

Deputy CISO at the U.S. Senate Sergeant at Arms, modernizing Splunk detection and piloting AI-assisted SOC analysis.

At the U.S. Senate Sergeant at Arms, I lead enterprise SOC, threat intelligence, threat hunting, network security, and information assurance engineering functions. I optimized the Splunk SIEM architecture, piloted AI-assisted analysis in SOC workflows, and directed incident response for high-severity events.

At CISA, I revamped the AWS network to strengthen security controls and prepare for Kubernetes migration. I also transitioned the Security Operations Team to an automated threat intelligence platform and advanced transformation planning for Threat Hunting operations.

Earlier, at DarkCubed, I deployed a self-healing, auto-scaling Kafka service and built a distributed Zeek monitoring container. At Fortalice, I implemented a custom log collection and intrusion detection system that saved $175K in development and annual costs.

Experience

Work history, roles, and key accomplishments

Current

Deputy Chief Information Security Officer

Current

U.S. Senate Sergeant at Arms

Feb 2025 - Present (1 year 8 months)

Leads enterprise SOC, threat intelligence, threat hunting, network security, and information assurance engineering functions. Directed optimization of SIEM architecture and piloted AI-assisted analysis tools in SOC workflows.

Splunk SIEM SOC Threat Intelligence Threat Hunting Network Security Incident Response AI Claude ChatGpt Gemini Copilot

Deputy Branch Chief (Acting), Cyber Defense Coordination

CISA

Dec 2022 - Feb 2025 (2 years 2 months)

Owned the network used for incident response and threat hunting operations; maintained Authorization to Operate (ATO). Revamped the CISA AWS network to strengthen security controls and prepare for migration to Kubernetes.

AWS Kubernetes Incident Response Threat Hunting ATO RMF Budget Management Security Operations

Section Chief, Content, Data & Integration

CISA

Dec 2019 - Dec 2022 (3 years)

Designed and managed the SOC monitoring the Threat Hunting network; achieved full ATO for the operational network. Migrated the environment from Windows-dominated to mixed technology and implemented agile project management standards.

SOC ATO Agile CI CD 2 Factor Authentication Secure Messaging Team Leadership

Senior Cloud Architect

DarkCubed

Jul 2019 - Dec 2019 (5 months)

Supervised and maintained corporate Kubernetes clusters across multiple geographic regions. Deployed a self-healing, auto-scaling Kafka service to ingest high-bandwidth network monitoring traffic.

Kubernetes Kafka Zeek Docker SSH RBAC 2FA Distributed Monitoring

Chief Information Security Officer

Fortalice

Sep 2014 - Jul 2019 (4 years 10 months)

Designed and implemented cloud infrastructure for a security monitoring system across two networks (Docker/Kubernetes). Implemented a custom log collection and intrusion detection system, saving $175K in development and annual costs.

Docker Kubernetes Cloud Infrastructure Log Collection Intrusion Detection Penetration Testing Risk Assessment OSINT

Director, Cyber Security

Executive Office of the President

Nov 2010 - Aug 2014 (3 years 9 months)

Designed and implemented the secure network for the President and First Family, including enterprise-grade encryption and intrusion detection. Migrated network security from custom-developed software to commercial monitoring systems, reducing downtime.

Network Security Encryption Intrusion Detection Monitoring C&A Continuous Monitoring

Branch Chief, Security Operations

Executive Office of the President

Aug 2007 - Nov 2010 (3 years 3 months)

Established the first 24x7 SOC for White House / EOP networks; managed a $5M contract and 14-person technical team. Led an upgrade to security and monitoring systems ($200K budget), moving from ad-hoc to threat-based monitoring.

SOC Security Operations Threat Monitoring Budget Management Team Leadership