Cristian Tomescu

Managing and analyzing cybersecurity alerts and incidents within the National Governmental CSIRT under DNSC, focusing on identifying threats, investigating incidents, and ensuring the confidentiality, integrity, and availability of critical systems.

Proficient in analyzing alerts using Stellar Cyber and Wazuh, and automating incident response through Cortex XSOAR (Palo Alto Networks) to streamline remediation workflows and enhance operational efficiency.

Responsibilities include identifying vulnerabilities, mapping adversarial behavior to MITRE ATT&CK, assessing root causes, and preparing technical and executive reports in both Romanian and English. These reports include incident descriptions, exploited vulnerabilities, attacker TTPs, conclusions, and actionable recommendations to improve preventive controls and overall resilience.

Experienced in firewall management and configuration, VPN/IPSec/SSL setup, and network security monitoring. Skilled in architectures and secure infrastructure management, including IDS/IPS, WAF, and DDoS protection.

Collaborating with internal and international stakeholders — including ENISA, the CSIRT Network, and CERT-EU — to coordinate cross-border incident responses, share threat intelligence, and develop unified operational guidelines. Actively contributing to risk assessments, implementation of DevSecOps best practices, and the continuous improvement of national cybersecurity posture through playbooks and automation.

Effectively coordinated and supported internal investigations into misconduct, ethical breaches, and fraud, leveraging digital forensic expertise to conduct evidence-based assessments. Organized and streamlined the work of the forensic team, ensuring clear task allocation aligned with case priorities and investigative complexity. Led and participated in on-site and remote digital forensic reviews, ensuring full compliance with legal standards and internal policies.

Identified and utilized the individual strengths of team members, assigning roles strategically to meet the technical and contextual requirements of each investigation. Proactively assessed team training needs and implemented targeted development initiatives to enhance investigative skills and technical capabilities. Provided hands-on mentorship and guidance, fostering a culture of professionalism, integrity, and continuous improvement within the team.

Retrieve data from virtual and physical (Bit-by-Bit .e01, .dd) devices, including mobile devices, computers, and memory drives. Execute Mobile Forensics and code analysis, extract and analyze metadata (e.g., timestamps, geolocation data, file ownership, device usage logs), and ensure the chain of custody for all digital evidence. Collect, process, analyze, and preserve digital evidence in criminal cases, adhering to industry standards and legal requirements. Write and review detailed reports on Digital Forensics cases, providing both technical analyses suitable for court proceedings and high-level summaries tailored to managerial or executive audiences.