🚫 Region Restricted

This page is only accessible from within Alberta or British Columbia.

Mark Augustus V. Funcion

Senior Cybersecurity Professional
📍 Edmonton, AB · Kamloops, BC
💼 linkedin.com/in/mark-funcion
🐙 github.com/kramnoic
Professional Summary

Senior cybersecurity professional with 8+ years in security operations, incident response, and threat detection across regulated financial market infrastructure (DTCC), government, and managed security services. Works hands-on with SIEM/XDR detection and response, threat hunting, red and purple teaming, and vulnerability management, with a track record of maturing security programs, tuning detection, and validating controls against MITRE ATT&CK. Comfortable leading incident response end to end and turning complex risk into clear, executive-ready guidance, working across infrastructure, development, and leadership teams in compliance- and audit-driven environments.

Core Competencies
Security Operations (SOC) & Monitoring
Threat Detection & Hunting
Incident Response & Forensics
SIEM & XDR — Sentinel / Splunk / QRadar
Red & Purple Teaming
Detection Engineering — MITRE ATT&CK
Vulnerability Management & VAPT
Cloud Security — Azure / AWS
Identity & Access Management
Security Tooling Optimization
Compliance & Audit — NIST / PCI / RegSCI
Reporting & Stakeholder Briefings
Professional Experience
Senior Information Security Analyst
Mar 2026 — Present
Thompson Rivers University — Kamloops, BC
  • Run institutional security operations across a hybrid Azure and on-premises environment, covering SIEM monitoring, incident response, vulnerability management, and identity and access control
  • Monitor, investigate, and respond to security events spanning endpoint, identity, cloud, and network, and analyze logs and telemetry to determine scope, impact, and root cause
  • Maintain security policy, procedures, and audit-readiness documentation, and build security requirements into system design across the institution
  • Brief faculty, staff, and leadership on risk in plain terms and deliver security awareness programs
Triage Security Engineer III
Apr 2024 — Mar 2026
Arctic Wolf Networks — Remote
Cleo MFT zero-day campaign. Part of the Arctic Wolf Security Services team that first discovered the Cleo Managed File Transfer zero-day and the succeeding mass-exploitation campaign — tracing an obfuscated PowerShell stager through a Java loader to a Java backdoor (dubbed “Cleopatra”) before it spread widely.
🔗 Credited by name as Mark Funcion — Arctic Wolf Labs: “Cleopatra’s Shadow: A Mass Exploitation Campaign”
  • Senior member of the Triage Security Engineering Team, setting detection quality and escalation standards across the SIEM/XDR platform for a large enterprise customer base
  • Perform deep-dive log, behaviour, and process analysis to determine scope and root cause, producing findings, remediation steps, and recommendations to strengthen client cyber resilience
  • Collaborate with the Incident Response team on threat impact determination, threat-actor identification, and TTP insight, feeding continuous improvement of detection rules and playbooks
  • Support tool maintenance, detection-logic improvement, and log-source tuning for SIEM and endpoint solutions, and mentor Tier 1 and Tier 2 analysts
Senior Cybersecurity Consultant
Apr 2024 — Apr 2025
SRG Consulting — Government of Saskatchewan
  • Led cybersecurity strategy and implementation across multiple government entities, ensuring compliance with internal policies and international standards including NIST, OWASP, and PCI DSS
  • Designed, launched, and operationalized the province's Cyber Red Team Program, establishing a proactive adversarial-simulation and defense capability
  • Integrated security validation into the GoS-CSRM five-year plan — application/network validation (DevOps), threat-based validation, and security-tool/vulnerability-assessment validation
  • Conducted enterprise-wide risk and vulnerability assessments with prioritized remediation, and reported posture, incident trends, and metrics to senior leadership
Senior Security Associate, Escalations Team Lead
Jul 2018 — Jan 2024
Depository Trust & Clearing Corporation (DTCC) — Manila
  • Led escalations and incident response per SLA at a SEC-regulated financial market infrastructure — validation, investigation, containment, remediation, and post-incident analysis
  • Served as RegSCI Assets Program Lead, owning SEC compliance artifacts for the design, testing, and maintenance of IT controls covering capacity, integrity, resiliency, availability, and security
  • Built and ran a Purple Teaming Lab (VMware vSphere, QRadar, CrowdStrike, Pentera, Caldera) and an off-hours attack-emulation program measuring the MSSP (ReliaQuest) on MTTI, MTTD, and playbook fidelity
  • Performed regular VAPT using NIST CSF and MITRE ATT&CK, delivering findings, severity matrices, and remediation steps
Lead Linux Infrastructure Engineer
Jan 2017 — Jul 2018
Depository Trust & Clearing Corporation (DTCC) — Manila
  • Led a team of Linux engineers with task assignment, SLA coordination, and mentorship — first formal people-management role
  • Managed 300+ RHEL, Solaris, and CentOS servers, hardened to CIS Benchmarks with Ansible, and kept security agents healthy (Splunk, Tripwire, FireEye, QRadar, Syslog-NG)
Cybersecurity & GIS/IT Consultant
Jan 2023 — Present
MASK2 Functional Cybersecurity Consultancy — CA/PH
  • Provide GIS and IT consulting to the Teslin Tlingit Council, a self-governing First Nation in Yukon, working directly with community stakeholders and respecting the Nation's data stewardship and priorities
  • Deployed a Wazuh XDR platform for a government science agency (DOST-STII), standing up their first security operations and monitoring baseline
  • Run vulnerability assessments and penetration tests on web applications and APIs, delivering exposure reports and prioritized fixes
Earlier IT & Support Engineering Roles
2003 — 2016
SolarWinds MSP · Semco Maritime · White & Case LLC · United Overseas Bank
  • Application & network support engineering at SolarWinds MSP (2013–2016), progressing from Intermediate to Senior Engineer
  • IT service desk, desktop support, and technical support roles across maritime, legal, banking, and BPO environments
Education & Certifications
Education
Bachelor of Science, Information Technology
Polytechnic University of the Philippines
Sept 2021
Cyber Security for Energy
Ontario Tech University
Mar 2024
Professional Designations
CIPS Information Systems Professional (I.S.P.)
CIPS — Canada's Association of I.T. Professionals
Active
CIPS IT Certified Professional (ITCP)
CIPS — Canada's Association of I.T. Professionals
Active
Professional Involvement
Mentor — CIPS Alberta Mentorship Program
Speaker & participant — BSides Edmonton 2024
Certifications & Training
ISC2 Certified in Cybersecurity (CC)
ISC2
Active
Microsoft Azure — Security & Fundamentals
Microsoft (AZ-500 / AZ-900)
Active
Certificate of Cloud Security Knowledge (CCSK)
Cloud Security Alliance
Active
Qualys Certified Specialist — VM & Cloud
Qualys
Active
MITRE ATT&CK Defender · Purple Teamer
MITRE / MAD · AttackIQ
Active
CEH · eJPT · CARTP
EC-Council · INE · Altered Security
Active
CCNA · Fortinet NSE 2 · Certified OT Security Professional
Cisco · Fortinet · OT security
Active
OSCP
OffSec
In progress
Microsoft SC-200 · CISSP / CISM
Microsoft · ISC2 / ISACA
Planned