Chief Information Security Officer
2020 - 2022The Kit Company- Built the overall information security program for the company.
- Achieved SOC2, Type 2 Certification, and HIPAA Compliance.
- Recreated and redeployed applications into ECS and Fargate using Terraform, providing hardened, increased security, elasticity, and reproducible environment.
Technologies: AWS Fargate, Docker, DevOps, GitHub, GitHub Actions, Cloudflare, SOC 2, HIPAA Compliance, Python, Vulnerability Assessment, IT Audits, Host-based Intrusion Prevention, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), Application Security, Python API, Web App Security, Risk Management, Disaster Recovery Plans (DRP), Virtualenv, Technical Training, Team Leadership, Management, Web Security, Cloud Security, SIEM, Threat Intelligence, Training, Compliance, Policy, Data Loss Prevention (DLP), Sumo Logic, MacOS, Team Management, Mobile Device Management (MDM), Amazon Elastic Container Service (Amazon ECS), AWS ALB, CISO, Ansible, Terraform, Web Application Firewall (WAF), OWASP Zed Attack Proxy (ZAP), Burp Suite, Amazon Firewall, VPN, IT Security, Security Audits, Security, SaaS, Web, Amazon Web Services (AWS), System Administration, Cybersecurity, Network Security, DevSecOps, CI/CD Pipelines, SoC, Architecture, Business Continuity & Disaster Recovery (BCDR), Security Architecture, Security Analysis, Content Delivery Networks (CDN), OWASP, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Data Privacy, GDPR, Technical Hiring, Task Analysis, Interviewing, APIs, Cloud, Source Code Review, CISSP, Vulnerability Identification, AuthenticationPrincipal Engineer
2015 - 2021AgileSecOps- Contributed to policies, procedures, compliance initiatives, and technical implementations. CISO as a Service provided guidance and direction related to security, keeping key business objectives in mind.
- Developed Python and PowerShell scripts to integrate other threat intelligence products into specific platforms and gained solid experience with RESTful APIs.
- Played a key role in vulnerability scanning and management and penetration testing of infrastructure, mobile, and web applications.
Technologies: AWS Fargate, Cloudflare, Python, Python API, HIPAA Compliance, HITRUST Certification, SOC 2, Firewalls, Web App Security, DevOps, Penetration Testing, Vulnerability Assessment, IT Audits, PCI Compliance, Host-based Intrusion Prevention, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), Application Security, ISO 27001, Risk Management, Disaster Recovery Plans (DRP), Virtualenv, Technical Training, Management, Google Cloud, Web Security, Cloud Security, SIEM, Windows, VMware, Threat Intelligence, Training, Compliance, Policy, Puppet, SaltStack, Data Loss Prevention (DLP), Sumo Logic, MacOS, Team Management, Mobile Device Management (MDM), Endpoint Detection and Response (EDR), Amazon Elastic Container Service (Amazon ECS), AWS ALB, CISO, Ansible, Terraform, PCI, Web Application Firewall (WAF), OWASP Zed Attack Proxy (ZAP), Burp Suite, Hacking, Ethical Hacking, Amazon Firewall, VPN, IT Security, Security Audits, Security, Okta, SaaS, Flask, Web, Amazon Web Services (AWS), System Administration, Cybersecurity, Network Security, DevSecOps, CI/CD Pipelines, Kubernetes, SoC, Architecture, Business Continuity & Disaster Recovery (BCDR), Security Architecture, Security Analysis, Content Delivery Networks (CDN), Consulting, Azure, Single Sign-on (SSO), OWASP, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Metasploit, Data Privacy, GDPR, Technical Hiring, Task Analysis, Interviewing, APIs, Cloud, Source Code Review, CISSP, Vulnerability Identification, AuthenticationSenior Manager of Information Security
2015 - 2016Copart- Rebuilt the security team to operate efficiently, with the ability to detect threats and maintain company compliances such as PCI, SOC2, ISO 27001, and Safe Harbor for over 180 locations worldwide.
- Led recertification of PCI environment by collecting evidence, recommending changes, and remediating issues.
- Spearheaded the internal risk management program to bind ownership of security risks with the appropriate business owners and provided an overview of risks to C-level executives.
- Installed Sumo Logic as the central syslog service and acted as the project lead, converting aging syslog and SIEM systems.
- Architected and deployed the intrusion detection systems and file integrity monitoring, including HIDS, NIDS, and FIM.
Technologies: Sumo Logic, PCI DSS, ISO 27001, Python, Vulnerability Management, Firewalls, Vulnerability Assessment, IT Audits, PCI Compliance, Host-based Intrusion Prevention, Intrusion Prevention Systems (IPS), Application Security, Risk Management, Disaster Recovery Plans (DRP), Team Leadership, Management, Web Security, Cloud Security, SIEM, Windows, Threat Intelligence, Training, Compliance, Policy, Data Loss Prevention (DLP), Team Management, Python API, Web App Security, Endpoint Detection and Response (EDR), Ansible, PCI, Web Application Firewall (WAF), OWASP Zed Attack Proxy (ZAP), VPN, IT Security, Security Audits, Security, SaaS, Web, System Administration, Cybersecurity, Network Security, Business Continuity & Disaster Recovery (BCDR), Security Architecture, Security Analysis, Content Delivery Networks (CDN), OWASP, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Data Privacy, Technical Hiring, Interviewing, APIs, Cloud, CISSP, Vulnerability IdentificationManager of Information Security
2014 - 2015Think Finance- Oversaw the daily operations of information security, networking, and telephony teams.
- Wrote and maintained policies and procedures to ensure compliance with PCI and company standards.
- Built and configured a central logging system based on Elasticsearch and Kibana.
- Converted all systems from traditional antivirus to Bit9 application whitelisting.
- Built and installed a network-based intrusion detection system.
- Incorporated the SaltStack configuration management for all Linux servers and wrote configuration to automate compliance to the Center for Internet Security benchmarks.
Technologies: Application Security, Vulnerability Management, Risk Management, PCI DSS, Data Loss Prevention (DLP), SaltStack, Vulnerability Assessment, PCI Compliance, Disaster Recovery Plans (DRP), Team Leadership, Management, SIEM, Windows, Threat Intelligence, Compliance, Policy, Team Management, Ansible, PCI, IT Security, Security Audits, Security, Web, System Administration, Cybersecurity, Network Security, Architecture, Security Architecture, Security Analysis, OWASP, Technical Hiring, Interviewing, Cloud, CISSP, Vulnerability IdentificationSecurity Officer
2012 - 2014Rally Software- Interfaced with the customers to answer security-related questions and coordinate the customer security testing.
- Composed and enforced the security and privacy policies.
- Oversaw all aspects of an eCommerce site's PCI compliance.
- Obtained the FISMA NIST 800-53 moderate compliance for SaaS offering and maintained the ISO 270001 compliance, EU Safe Harbor, and HIPAA.
- Deployed the hose-based intrusion detection and network-based intrusion detection systems in both the corp and production environments.
- Collaborated directly with the operations administrators in a security and operations function.
- Performed vulnerability and penetration testing on a SaaS application offered by the company.
- Conducted periodic application reviews while interfacing with developers to solve security issues.
- Wrote the disaster recovery policy for the production environment and acted as the key contributor to the corp disaster recovery documentation.
Technologies: Application Security, Vulnerability Management, PCI DSS, ISO 27001, Linux, Puppet, Python, Bash Script, Policy, Disaster Recovery Plans (DRP), Vulnerability Assessment, IT Audits, PCI Compliance, Host-based Intrusion Prevention, Intrusion Prevention Systems (IPS), Web App Security, Risk Management, Team Leadership, Management, Web Security, SIEM, VMware, Threat Intelligence, Training, Compliance, SaltStack, Data Loss Prevention (DLP), MacOS, Team Management, CISO, PCI, Web Application Firewall (WAF), OWASP Zed Attack Proxy (ZAP), VPN, IT Security, Security Audits, Security, SaaS, Web, System Administration, Cybersecurity, Network Security, Business Continuity & Disaster Recovery (BCDR), NIST, Security Architecture, Security Analysis, OWASP, Dynamic Application Security Testing (DAST), Data Privacy, Technical Hiring, Interviewing, Cloud, CISSP, Vulnerability Identification, AuthenticationGlobal Information Security Engineer
2012 - 2012Prologis- Provided all aspects of corporate security support, guidance, engineering, and management.
- Built and replaced an aging network-based intrusion detection system.
- Identified and managed the clean-up efforts of several botnets and other malicious infected systems located within the company’s worldwide infrastructure.
- Installed the central logging and reporting capability to support security and infrastructure administrators.
Technologies: Python, Intrusion Detection Systems (IDS), SIEM, Penetration Testing, Threat Intelligence, Training, Policy, Risk Management, IT Security, Security Audits, Security, System Administration, Cybersecurity, Network Security, Security Analysis, Vulnerability IdentificationLead System, Network, and Security Engineer
2009 - 2012Tendril Networks- Assessed compliance with the information technology controls and tested application technologies, development projects, data center operations, security, and information technology-related work processes.
- Developed and maintained the processes to include the security incident response, vulnerability assessment and scanning, patch management, security metrics and reporting, security event management, protection of PII, and encryption.
- Assessed the risk and internal operating controls by identifying areas of non-compliance and identified operational weaknesses, inefficiencies, and issues.
- Performed penetration testing and vulnerability scans by utilizing BackTrack, Metasploit, Nessus, John the Ripper, Nikto, Nexpose, Burp Suite, and w3af.
Technologies: Python, Compliance, PCI DSS, Penetration Testing, Vulnerability Management, Web Security, Threat Intelligence, Policy, Puppet, Risk Management, Team Management, IT Security, Security Audits, Security, Web, System Administration, Cybersecurity, Network Security, Architecture, Security Analysis, OWASP, Technical Hiring, Interviewing, Cloud, Vulnerability IdentificationSecurity and Operations Center Linux Administrator
2008 - 2009DigitalGlobe- Provided the security and administration support for Linux RHEL 5, Windows (XP, 2003, 7, 2008), Solaris 10, and IRIX systems.
- Troubleshot and resolved issues with the infrastructure components and company-built specialized software applications.
- Wrote scripts and programs to automate the monitoring and administration processes.
Technologies: Python, Vulnerability Management, Linux, Windows, VMware, Policy, VPN, IT Security, Security, Web, System Administration, Cybersecurity, NIST, Vulnerability IdentificationIntelligence and Network Security Administrator
1994 - 2008U.S. Air Force- Managed a development project team for network security attacks.
- Acted as the certified instructor and developer for the first-ever Air Force undergraduate network warfare course.
- Instructed students on the defense of hacker techniques and the use of malicious software, utilizing Linux hosts with Ruby, Python, and shell scripting.
- Performed penetration testing with open source software such as NMAP, Nessus, and Metasploit, and other malicious code found on the internet consisting of C++, Python, and shell scripting.
Technologies: Penetration Testing, Python, Compliance, Training, Threat Intelligence, Firewalls, Virtualenv, Vulnerability Assessment, Application Security, Technical Training, Team Leadership, Management, Web Security, Windows, Policy, Data Loss Prevention (DLP), Risk Management, Team Management, Web App Security, Mobile Device Management (MDM), HIPAA Compliance, Web Application Firewall (WAF), Military Operations, Hacking, Ethical Hacking, IT Security, Security Audits, Security, System Administration, Cybersecurity, Network Security, SoC, NIST, Security Analysis, OWASP, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Metasploit, Technical Hiring, Vulnerability Identification, Authentication