Open to opportunities

Kevin Underwood

@kevinunderwood

Principal cybersecurity architect specializing in operational technology security, NERC CIP risk assessments, and threat intelligence.

United States

Message

What I'm looking for

I’m looking for a technical cybersecurity architect or engineering role with a professional company where I can use my skills to build products/services that furthers the mission.

I’m a cybersecurity architect focused on Operational Technology (OT) environments, where operational risk and real-world constraints demand practical, resilient security. As a Principal Cybersecurity Architect at PPL, I architect OT cybersecurity solutions using network segmentation and system hardening, and I assess operational risk across electric and natural gas networks. I also serve as a technical member of the Cybersecurity Incident Response Team (CISRT) and monitor multiple threat intelligence sources tracking nation-state actor techniques, tactics, and procedures.

Previously at Dragos, I led field-operations cybersecurity architecture for passive network security monitoring in complex industrial settings. I architected AWS transit gateway VPC communications, simplified and scaled Dragos Platform deployments, and managed production cloud firewalls for AWS Dragos platforms. I also supported and troubleshot production installations worldwide, and I identified deployment inefficiencies—then programmed and automated solutions using scripted installation scripts and configuration automation via Puppet.

Earlier in my career, I built OT-focused security capabilities for power generation and grid systems, including an NERC CIP-aligned remote-monitoring solution. I developed a real-time alert analytics engine that improved gas turbine trip detection from hours to seconds, and I supported cybersecurity consulting for smart grid architecture and assessments. I also worked on foundational smart grid product security—architecting and testing the first ZigBee-certified home area network solution for a GE smart meter platform—and I bring that same blend of security depth, engineering execution, and fast learning to every mission I join.

Experience

Work history, roles, and key accomplishments

Current

Principal Cybersecurity Architect

Current

PPL Services Inc

Apr 2021 - Present (5 years 2 months)

Architected OT cybersecurity solutions for electric and natural gas networks, including network segmentation and system hardening, and led NERC CIP risk assessments. Served as a technical member of the Cybersecurity Incident Response Team (CISRT) and monitored threat intelligence for nation-state TTPs.

NERC CIP OT Cybersecurity Segmentation System Hardening Risk Assessment Incident Response Threat Intelligence

Principal Field Operations Cybersecurity Architect

Dragos Inc

Jul 2018 - Apr 2021 (2 years 9 months)

Provided key technical leadership for industrial field operations by architecting and implementing passive network security monitoring in complex industrial environments. Designed AWS transit gateway VPC communications and managed production cloud firewalls, streamlining and scaling deployments while supporting $10M+ in technology delivery worldwide.

Network Monitoring Industrial Cybersecurity VPC Gateway Puppet

Aeroderivative Cybersecurity Architect

GE Power

Mar 2015 - Jul 2018 (3 years 4 months)

Architected a remote-monitoring solution for OT control systems in accordance with NERC CIP V5 regulations. Developed a real-time alert analytics engine that reduced gas turbine trip detection from hours to seconds and acted as an internal cybersecurity consultant.

NERC CIP Remote Monitoring Real Time Analytics Alerting Systems Architecture Cybersecurity Consulting

Senior Security Consultant/Engineer

Securicon

Aug 2012 - Feb 2015 (2 years 6 months)

Led penetration-testing engagements for smart grid equipment, infrastructure communications, and enterprise/web applications, including smart grid architecture reviews. Conducted NERC CIP risk assessments and researched software-defined radios, SCADA exploitation, and reverse engineering.

Penetration Testing Smart Grid Security Infrastructure Communications NERC CIP SCADA Security Reverse Engineering

Smart-Grid Software/Security Engineer & Technologist

GE Digital Energy

Nov 2009 - Aug 2012 (2 years 9 months)

Architected, developed, and tested the first ZigBee-certified home area network solution for a GE smart meter platform. Performed security assessments of smart grid products and served as an internal consultant for ZigBee home area networks and smart-grid cybersecurity.

Zigbee Smart Meters Smart Grid Cybersecurity Security Assessments IoT Security

C-17 Software Systems Engineer

United States Air Force

Jun 2007 - Nov 2009 (2 years 5 months)

Participated in test and evaluation systems engineering milestone reviews (SRR/PDR/CDR/TRR) for the flight data recorder and weather radar line replaceable units. Managed technical aspects of acquisition contracts supporting development of the test and evaluation laboratories.

Software Systems Engineering Engineering Reviews Flight Data Recorder Systems Weather Radar Systems Technical Support