Open to opportunities

Ryan MacCubbin

@ryanmaccubbin

Message

Cyber threat intelligence manager specializing in threat hunting, CTI program design, and incident response.

United States

Message

What I'm looking for

I seek roles where I can lead CTI or threat-hunting teams, operationalize intelligence into SOC workflows, mentor analysts, and strengthen detection and incident response capabilities.

I am a cybersecurity professional with more than 10 years of experience designing and operating threat detection, incident response, and cyber threat intelligence programs.

I designed and implemented a enterprise Cyber Threat Intelligence (CTI) program and Insider Threat Program at Baylor Scott & White Health, integrating TIPs, TAXII feeds, MITRE ATT&CK-based hunting, and SIEM alerting to operationalize intelligence.

Previously I administered and tuned Splunk Enterprise Security, Microsoft Defender for Endpoint, Snort IDS/IPS, EDR/AV, and conducted threat hunting, packet analysis, and vulnerability scanning for Bureau of Indian Affairs and other customers.

I teach and mentor aspiring analysts, hold CompTIA Security+ and Network+ certifications, and maintain a passion for continuous learning and disciplined operational security.

Experience

Work history, roles, and key accomplishments

Current

Manager, Cyber Threat Intelligence

Current

Baylor Scott & White Health

May 2024 - Present (1 year 10 months)

Designed and implemented the enterprise Cyber Threat Intelligence program and Insider Threat Program, operationalized Recorded Future TIP and TAXII feeds, and deployed MITRE ATT&CK–driven threat hunting and SIEM detections to improve SOC coverage and response.

Threat Intelligence Recorded Future Threat Hunting SIEM

Cybersecurity Engineer

Akima, LLC

Nov 2022 - May 2024 (1 year 6 months)

Administered Microsoft Defender for Endpoint and Splunk SIEM, provided Tier 2 incident response guidance, conducted proactive vulnerability scans and threat hunts, and developed Snort rules and custom detections for known adversary TTPs.

Microsoft Defender Splunk Incident Response Threat Hunting Snort TTP IOC Detection

Industry Mentor Instructor

Cybertek, LLC

Nov 2022 - Apr 2024 (1 year 5 months)

Delivered weekly virtual cybersecurity classes and SOC tool/process workshops, conducted practical labs and mock interviews to prepare students for SOC analyst roles.

SOC Interview Preparation

Cybersecurity Analyst

Akima, LLC

Sep 2019 - Nov 2022 (3 years 2 months)

Monitored networks with HIDS and Snort, created Splunk ES alerts, performed packet and OSINT analysis with Wireshark/Tshark/Endace, and led vulnerability scanning and remediation efforts to harden network security.