How to word a few things on my resume

logisticalstyles

My Director recently told me I have a promotion coming my way and asked me to get a resume ready to present to our executive committee.  While I am excited to get the news of a promotion, I am still considering going elsewhere. I am going to use the time to shop my resume around to see what else is available.  I want to include some wording to highlight the fact that I was part of the response team when we got hit by ransomware. The problem is I don't want to let people know that my firm got hit by ransomware.   I also want to add a line to highlight that I was a big part of transitioning the firm to WFH at the beginning of the COVID lockdown.  Any suggestions on how to add these two pieces of info tactfully to my resume?

JDMurray

Do you have experience handling Malware incidents prior to your present company? If not, any mention of handling an active Ransomware incident will cause people to infer that it was your present company that was hit. You could say "first-hand experience detecting/mitigating/remediating active Malware incidents on devices, systems, and networks" and not specifically mention Ransomware. You would then go into more detail in your first-round interview(s).

As for the WFH in 2020, that hit every business in the US, so no problem with "outing" your present employer on that one.

logisticalstyles

I see, so instead of listing as one of my current job responsibilities, I should list it under my Skills Summary. That makes perfect sense. Thanks! 

JDMurray

List it under both, but make it as ambiguous as reasonible so you are not giving away unique details about a specific employer (e.g., a Ransomware incident).

yoba222

Slightly off topic, but nearly all US States have breach notification laws and not reporting a ransomware attack is probably breaking some law. If they reported it, it's already public knowledge.

JDMurray

Those are "data breach" notification laws. In Ransomware attacks,  data is encrypted and held for a ransom reward. There is typically no "leak" or "breach" of the data per se. If the target of the Ransomware attack can't find evidence that the data was exfiltrated from the target's control then there was no (data) breach.

UPDATE: The Verizon 2021 DBIR Executive Summary states, "Ransomware appears in 10% of breaches—more than double the frequency from last year. This upward move was influenced by new tactics, where some ransomware now steals the data
as they encrypt it. That puts Ransomware now in third place among actions causing breaches."