Initial security hire on Growth and Scale team for 8m+ MAU multi-tenant SaaS student learning application. Spearheaded successful effort to achieve SOC 2 certification - established comprehensive security policy set and formalized Secure Software Development Lifecycle (SSDLC) and incident response, vendor management and risk management processes. Implemented Vanta GRC tooling, including custom integration with main application. Led internal Security and Data Privacy Working Group, coordinating security efforts with legal, customer success, IT, and HR teams. Advised engineering teams regarding application security, architecture, IdAM, and security by design at all phases of the project lifecycle. Bootstrapped and led risk assessment, threat modelling, and disaster recovery exercises. Facilitated annual penetration tests, external audits, and managed bug bounty program.

Implemented numerous features and bugfixes in Python/Typescript/React/Angular codebase as part of Core Systems team, including migrating large-scale (5m+/day) application email-sending from Mailgun to AWS SES, automating AWS key rotation, and building internal administration tooling. Implemented and supported core initial RBAC implementation, including tooling for synchronizing roles into main application database from Salesforce contracts. Triaged, mitigated and remediated internally-identified and bug-bounty-submitted vulnerability reports across the application. Reviewed feature designs and code changes from developers on multiple teams for security concerns.

Member of four-person development team responsible for all aspects of development on https://fiveable.me/ and related sites. Implemented application features (both frontend and backend) in two different applications, primarily Javascript/Typescript/React-based. Instrumental in setting architecture direction for the overall application. Led code maturity project, guiding team in migrating significant portions of legacy Javascript code to Typescript and modernizing backend code-base to use a well-structured architecture. Refactored local development experience to provide for a straightforward "check out and run" onboarding experience into the code.

Spearheaded migration of platforms from disparate and chaotic hosting environments into Google Cloud Platform, with consolidated and robust CI/CD pipelines. Implemented highly-scalable video-conferencing system using Jitsi software running in Google Kubernetes Engine. Consolidated numerous logging sources into single cloud log sink and implemented traceability within code to provide for better visibility of issues and troubleshooting.

Principal developer and customer liaison for New Context's LS/IQ virtual CISO SaaS product. Responsible for ground-up rewrite of aging Ember/Ruby on Rails/Postgres application into modern Vue.JS/Typescript/GraphQL/MongoDB application, as well as implementation of Infrastructure-as-Code for AWS-based infrastructure. Modernized legacy Jira integration and worked with Product Manager to design and develop new application features.

Worked directly with customers as "virtual CISO", to set direction and prioritize steps in their DevSecOps journey. Provided white-glove security and DevOps consulting to C-levels at multiple clients.

Consultant and team lead on multiple client projects, including Application Security program review and revitalization for worldwide insurance company, developing proof-of-concept secure IoT device provisioning system, and full-stack application development and support for production IoT platform.

Developed SoWs & project proposals, solution design and architecture, and acted as embedded project management for small development teams.

Conducted technical interviews of candidates for employment, worked with Hiring Committee for design/review of interview process, and worked closely with HR to drive focus on Diversity and Inclusion in hiring process.

Application development and support for RiskIQ's primary SaaS application. Full-stack development work in an Agile SDLC on a React-based application with Java/Grails backend. Responsible for end-to-end implementation of PingFederate-based SSO solution, including SAML2 integrations with multiple partners. Dealt with day-to-day application support, enhancements, troubleshooting, and bug fixes. Responsible for continued support and expansion of reporting system. Worked with fellow developers to remediate application security vulnerabilities and implement processes to prevent reoccurence. Actively engaged in day-to-day support of other departments based around the globe.

Worked directly with RiskIQ customers to solve complex issues around application support and integration into customer environments. Developed RiskIQ's original Splunk and ArcSight integrations. Used Angular, jsreport, node.js, and Docker in AWS to create a custom reporting solution for Customer Success organization, including report templates, user interface, and back-end integration with company data services.

Spearheaded design and implementation of Enterprise XML Gateway functionality using IBM DataPower Appliances and X.509 Certificates as part of Enterprise SOA initiative. Acted as Information Security specialist on commercial banking upgrade project utilizing SOA architecture.

Acted as architect for Application Security decisions and projects within the Information Security team, as well as working heavily with other teams to create architecture standards to be used across the bank. Member of Enterprise Architectural Review Committee, providing architecture-level input and gate-level decision-making for new projects being implemented within the bank. Worked with many teams across the enterprise to maintain a good working relationship with other departments and to ensure Information Security's involvement in projects at an architectural level.

Successfully launched monthly Application Security training program based on OWASP Top 10, with average monthly attendance of 50 people.

Planning monthly meetings, scheduling meeting location, contacting speakers, and providing content for local chapter of global Application Security organization.

Volunteer software developer and technology adviser for various non-profit and progressive political organizations.