Ricky Tipler

1. 2023 – Present Brookdale Senior Living

   Cybersecurity Specialist

   Security specialist at the largest operator of senior housing in the U.S., protecting 30,000+ employees and patients — detecting threats, managing access, and securing critical healthcare systems across enterprise security tooling.

   • Engineered SIEM detection pipelines: onboarded new log sources and rewrote alert logic for broader threat coverage and a significant reduction in false positives.
   • Deployed and validated EDR across 21,000+ endpoints, auditing agent health, telemetry ingestion, and detection gaps for full device visibility.
   • Conducted threat hunting using a threat intelligence platform to surface active IOCs and threat-actor TTPs, pivoting intel into SIEM and EDR to catch compromise before alerts fired.
   • Integrated vulnerability scanning into server onboarding — critical/high findings must be remediated before production deployment.
   • Spearheaded SOAR adoption to orchestrate response actions (IP blocking, account suspension, endpoint isolation), compressing containment time.
   • Automated repetitive security validation and asset review with PowerShell, cutting manual effort by 75%.
   • Managed the lifecycle of 850+ SSL/TLS certificates using certificate management tooling to prevent outages from expired certs.

   • SIEM
   • EDR
   • Threat Intelligence
   • Vulnerability Management
   • SOAR
   • PowerShell
   • Certificate Management
2. 2021 – 2023 State of Tennessee

   Information Security Administrator

   Secured computer systems across 11 state correctional facilities — access controls, endpoint hardening, and incident response, keeping inmate computer use within approved boundaries.

   • Led end-to-end design and deployment of a secured, inmate-operated call center: hardware procurement, network placement, firewall rules, and GPO security baselines across 300+ endpoints.
   • Led full insider-threat investigations from detection through resolution, analyzing access logs and unauthorized activity — resulting in tightened access controls and a policy change to prevent recurrence.
   • Built PowerShell automation for security compliance checks across endpoints, cutting manual validation time and keeping systems audit-ready.

   • Access Control
   • Endpoint Hardening
   • Incident Response
   • GPO
   • PowerShell

• May 15 · 6 min read Active Directory Certificate Services Abuse: The Hidden Path to Domain Compromise How AD CS misconfigurations let attackers escalate domain privileges without ever touching a password.
• Jul 1, 2024 · 6 min read LetsDefend Detection Engineering Path — Week 2 Course notes on secure network topology design from week 2 of a detection engineering path.
• Jun 11, 2024 · 7 min read LetsDefend Detection Engineering Path Kicking off a self-directed path to build threat detection, incident response, and log analysis skills.
• Jun 13, 2023 · 6 min read Enhancing Web Server Security with ModSecurity and OWASP CRS A walkthrough of locking down a web server with ModSecurity and the OWASP Core Rule Set.

More on Hashnode →