TIM CARREIRA

Voya Financial · Windsor, CT

• Returned to Voya to build the enterprise insider threat program as its senior individual contributor: strategy, governance, detection engineering, and investigative workflows across DLP, UEBA, and SIEM.
• Run insider risk investigations from triage of behavioral detections through forensic collection and analysis, investigative interviews in partnership with HR and Legal, and case reporting to executives.
• Engineer AI-assisted DFIR workflows using Claude and self-hosted LLMs to speed up triage enrichment, evidence summarization, and report drafting while keeping sensitive case data in-house.
• Lead proactive insider threat hunts across enterprise data sources to catch data exfiltration and misuse early; develop new risk indicators with Privacy, HR, Legal, and Fraud partners.

State Street Corporation · Boston, MA

• Led development of a multi-cloud (AWS, Azure, OCI) CSPM capability within Cloud Application & System Security Engineering; matured incident detection & response automations with Wiz Defend and Wiz Cloud.
• Drove remediation of MRAs and other regulatory findings.

State Street Corporation · Boston, MA

• Built and led the Cloud Security Operations program: strategy, governance, and purple-team exercises that matured cloud incident response against a two-year capability roadmap.
• Reported exercise metrics and written assessments to senior stakeholders; partnered with Privacy, HR, and Legal on sensitive investigations.

State Street Corporation · Boston, MA

• Cloud IR Lead in the Global Cyber Defense Center: rapid containment, triage, and event reporting across AWS, Azure, and OCI.

Voya Financial · Windsor, CT

• Directed insider threat investigations, advanced hunts, and forensics involving fraud, data exfiltration, and privacy incidents; conducted investigative interviews and briefed outcomes to business stakeholders.
• Designed and ran enterprise tabletop exercises covering ransomware, insider threat, DLP, and cloud IAM; mentored a global analyst team.
• Architected and maintained a cloud-based DFIR lab for digital forensics, malware analysis, and casework.

Voya Financial · Windsor, CT

• Incident commander for critical cybersecurity response; delivered quick-turnaround security assessments for time-sensitive business matters.
• Built advanced Splunk detections and dashboards for behavioral anomalies and insider threat TTPs across multiple application log sources.
• Investigated and contained insider cases involving data misuse, fraud, and privacy violations; partnered with HR and Legal on interviews and produced executive summaries for stakeholders and third-party regulators.

Voya Financial · Windsor, CT

• Triaged and contained a high-volume caseload across DLP, privacy, malware, phishing, and data-handling violations.
• Automated SIEM root-cause analysis and EDR response actions with behavioral analytics; communicated findings to business leadership through concise reports and post-incident reviews.

Engineering Industries eXcellence / Design Automation Associates · Windsor Locks, CT

• Sole IT and security owner for a 50-person ITAR defense-aerospace engineering firm across three offices — multi-site networks, Windows/Linux servers, endpoints, and NIST-aligned security.
• Earlier stint with the firm as an IT Support Specialist (Jan 2009 – Jan 2011).

• Built and operate a live intelligence pipeline that mines federal court records (CourtListener/RECAP, targeted PACER) plus curated news and community feeds for real insider threat cases — theft, leaks, and sabotage.
• LLM-assisted extraction maps each filing to Insider Threat Matrix™ techniques, with confidence scoring, an evidence ledger separating definitive artifacts from inferred leads, and hunt reports with ready-to-run SIEM, email, and chat queries.
• Designed and built entirely with Claude Code.

• Self-hosted LLM lab (Ollama on NVIDIA DGX Spark) for investigative AI experiments that keep data local; Google GEAR (Gemini Enterprise Agent Ready) program participant, building and evaluating AI agents for security workflows.