Aaron Bryson Email & Phone Number

Seattle, Wa, Us

Bezos Academy is building a network of tuition-free, Montessori-inspired preschools in under-resourced communities. Our preschools offer year-round programming, five days a week, for children ages 3-5.About my role:●Develop DevSecOps capabilities, including identifying security scanning tools (SAST, DAST, IAST, SCA, RASP) to be integrated into Software Development Lifecycle (SDLC) processes, including CI/CD pipelines.● Design and guide the implementation of secure SDLC best practices and tools, including threat modeling, architecture, design and code review security checklists, secured software supply chain, and vulnerability assessment.● Lead incident response activities to investigate security incidents and implement remediation plans.● Conduct regular security assessments (fuzzing, penetration tests, red teaming) and audits on security design to identify vulnerabilities, assess security risk, and develop design and mitigation strategies.● Create system threat models for mobile and web software applications we are building.● Working with cross-functional teams to drive security through each system component.● Stay current with the latest security trends, threats, and technologies, including researching, evaluating, and implementing new security solutions to meet an ever-evolving security risk posture.● Develop and maintain security policies, procedures, and standards for our AWS infrastructure.● Conduct regular communications to bring awareness to security threats and advocate forsecurity practices.

Remote, California, Us

Managed the Blue Lava security program and achieved the following:●Reduce operational spending and overhead, managed budget●Improve business and engineering/product team agility through security enablement and faster processes●Did more with less●Consolidated tools and licensing●Improved technology and increased automation Increased visibility, detection, monitoring, and auditing capabilities ●Implemented and enhanced Secure SDLC and secure software development policies and practices, source code control, secrets management, key management, and API management●Worked with the product team on the Auth0 authentication implementation to support Single Sign-On (SSO) and form-based authentication, account lifecycle, and password reset workflows●Worked with Agile developers and engineers to help them improve our application and cloud security posture, and implement solutions●Implemented application security best practices according to SAMM and BSIMM, including publicizing secure coding guidelines, checklists, requirements, research, static and dynamic code analysis, threat modeling, awareness training, and risk matrix●Reduced our attack surface for all assets including our cloud-based application containers●Improved our security maturity scores in various categories, including SOC2, NIST, AWS Foundational Security Best Practices, CIS Benchmarks, AWS Well-Architected Framework, and Blue Lava's proprietary CMM●Implemented vulnerability management from code to infrastructure and runtime●Implemented security awareness training, policies, and procedures●Implemented the new website backend and various aspects of the new branding●Completed two annual SOC2 audits●Helped support dozens of pre-sales and post-sales efforts with the sales team, resulting in new revenue and contract renewals●Provided support to the customer community●Acquired and managed the entire IT responsibility and successfully managed it with fewer man-hours and less monthly spending

Waterloo, Ontario, Ca

A heavy amount of customer and client-facing experience was involved which included contract negotiations and writing, requests for proposals, statements of work, and client deliverables. In addition, it included dealing with many tense situations, resolving conflict, navigating global cultural differences and bureaucracy, putting out countless fires, and earning (and sometimes saving) high-profile and high-dollar customer accounts.Technically, I was focused on securing product (applications and services) infrastructure, data, and code within cloud environments in Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP) for numerous clients. Responsibilities included: Responsibilities included: ●Network Security●Logging and Monitoring●Identity and Access Control●Data Protection●Vulnerability Management●Inventory and Asset Management●Secure Configuration●Malware Defense●Incident Response●Identity and Access Management●Compliance●Storage Storage●Database Services●Logging and Monitoring●Networking●Virtual Machines●Internet-of-Things (IoT)

Waterloo, Ontario, Ca

An initial key hire for building the security consulting practice; made Cylance's first $1. I consulted directly for Cylance and BlackBerry's clients from every industry vertical worldwide, including many Fortune 500s. Responsibilities included security, privacy, compliance, risk, and product engineering. Cylance® was one of the fastest-growing companies in the history of cybersecurity. Cylance is revolutionizing cybersecurity with products and services with machine learning and artificial intelligence. Our technology is deployed on millions of endpoints and protects thousands of enterprise clients worldwide including Fortune 100 organizations and government institutions.Cylance’s security solutions provide full spectrum predictive threat prevention and visibility across the enterprise, combatting threats such as malware, ransomware, file-less malware, malicious scripts, weaponized docs, and other attack vectors. With AI-based malware prevention, application and script control, memory protection, device policy enforcement, root cause analysis, threat hunting, automated threat detection, and response, coupled with expert security services, Cylance can protect endpoints without increasing staff workload or costs.Responsibilities were extensive and included:-Owning and managing all aspects of the Professional Services team, which delivers design, implementation, and strategic consulting services to Cylance customers worldwide-Owning the Professional Services P&L and looking for new and sustainable ways to increase our margin, increase revenue and renewals, and improve forecasting-Pre- and post-sales support to increase customer confidence and earn new deals-Composed proposals, and statements of work (SOW), and then managed ongoing delivery to ensure projects are on time, in-budget, and meet our quality standard-Created and enhanced numerous processes resulting in efficiency gains, time-saving, cost reduction, and reduced operational overhead

Austin, Tx, Us

●Saved a high-profile and high-value customer deal in excess of $20,000,000 leading to contact renewal and a new and improved partner relationship by working directly with their CISO. Put at numerous client-facing fires and was involved in many pre-sales and post-sales endeavors. ●Help to drive the enterprise architecture vision, service & application designs, security protocol designs, and engineering to deliver the most secure Mobile Application Development Platform (MADP) and Mobile Backend-as-a-Service (MBaaS) in the market.●Closely collaborate with the stakeholders, architects, and engineering teams and drive key security design choices made in the implementation of the product.●Identify and anticipate security solution requirements based on tactics, techniques, and procedures of adversaries. Conceptualize and evolve enterprise security architectures for Kony’s solutions.●Lead and drive the security technology & architectural aspects of the product roadmap to enable building usable and secure solutions. We created a more secure, efficient, transparent, and customer-friendly product.●Worked with product management and engineering to achieve industry leadership recognition by Gartner Magic Quadrant for Mobile Application Development Platforms & Forrester in the Forrester Wave: Mobile Low-Code Development Platforms.●Coordinate with Infosec and Governance, Risk, and Compliance (GRC) teams in the alignment of industry security standards, compliance requirements, and certifications (GDPR, ISO, HIPAA, PCI, SOC2, and STIG/SRG).●Assist in building, managing, and enhancing best practices and security tool integrations into the DevOpsSec workflow.●Identify, collaborate, and oversee security issue identification, mitigation, resolution, and elimination in various stages of product development to ensure systemic issues are resolved.●Mobile security evangelist; public speaking, writing blogs, and whitepapers, and knowledge sharing with clients and partners.

Burlington, Massachusetts, Us

Veracode Manual Penetration Testing (MPT) complements their automated scanning technologies with best-in-class penetration testing services to find business logic and other complex vulnerabilities in the web, mobile, desktop, back-end, and IoT applications.Using a proven process to ensure high customer satisfaction, Veracode MPT provides detailed results, including attack simulations, through the Veracode Application Security Platform, where both manual and automated testing results are assessed against the client's corporate policy.Regulations including PCI DSS, HIPAA, GLBA, FISMA, and NERC CIP require penetration testing, and security frameworks such as OWASP Top 10 and SANS Top 25 require penetration tests.Veracode uses standardized testing processes that ensure consistency while enabling consultants to apply their individual expertise. Veracode MPT focuses on identifying issues that require a manual tester’s insight and delivers results that are easily consumed by both development teams and auditors, including attack simulations showing how an attacker would exploit a vulnerability.●Assisted many Veracode clients in the management and operation of their application security programs●Responsible for research of vulnerabilities in software, firmware, and devices, and modern exploits and exploitation techniques. Developing proof-of-concept attacks, analysis of emerging threats, and research of effective mitigation and security technologies●Developed security testing tools as well as presented research results at conferences●Responsibilities included threat assessment, vulnerability assessment, penetration testing, architecture and design security reviews, and design of security components to ensure the security of products, technologies, and systems. Partially responsible for the development and delivery of security training and classes●Maintain continuous and substantial knowledge of state-of-the-art security principles, theories, and attacks

San Jose, California, Us

Provided subject matter expertise and acted as a trusted advisor on cybersecurity. Using our Enterprise consultative mindset and approach, we partnered with our clients to design solution architecture and evangelize underlying information security principles.Contributed to the security community through the publication of high-quality articles or public presentations of research or innovative concepts at industry conferences or interest groups.●Taught Foundstone Ultimate Hacking series of hands-on classes to organizations in both the private and public sector●Supported the sales team with the identification and development of professional service opportunities for McAfee and business partners●Understanding enterprise security strategy and where it fits within an organization enabled us to meet the client's business goals and requirements.●Understanding market issues and trends affecting business and the use of IT/OT within various sectors●Maintained and expand client contact at high levels and build credible relationships with key client personnel.●Managed complex multi-faceted security testing assignments. Program-managed and project-managed geographically distributed projects ●Managed the development and quality assurance of security test deliverables, development of appropriate remediation plans, and translated technical information into business risk for non-technical contacts●Performed a variety of advanced security services, including red teaming, infrastructure, application assessments, and strategic planning for information security programs.

Gosu Security is an experienced security consulting firm providing cyber, information, and application security services to clients in many industries. Our seamless integration of functional expertise and deep industry knowledge is the key to our client services. We provide the following services:► Virtual CISO (vCISO) services► Web/Mobile/IoT/Application Penetration Testing► Secure Software Development Life Cycle (SDLC) Strategy and Implementation, guidelines, checklists, training, processes, etc.► Static Application Security Testing (SAST)► Dynamic Application Security Testing (DAST)► Threat Modeling► Architecture solution design and review► Policy/standard/guideline creation and review► Critical Controls and Best Practices Review► Amazon AWS and Microsoft Azure Security AssessmentsIndustries we regularly provide services to:► Independent Software Vendors► Automotive► Financial Services/Tech► Healthcare Systems/Services► High Tech► Media & Entertainment► Pharmaceutical & Medical Products► Retail/E-Commerce► Telecommunications► Travel, Transport, & LogisticsWe work with organizations across the private and public sectors. We have deep functional and industry expertise that allows us to provide meaningful security services. We are passionate about taking on immense challenges that matter to our clients.By building your capabilities and skills at every level and every opportunity, we help build internal support, identify real issues, and reach practical recommendations. We bring out the capabilities of clients to fully participate in the process and lead the ongoing work.Our consultants have integrity, sharp analytical minds, leadership potential, creativity, and the ability to work with people at all levels in an organization. We value support, caring, trust, and respect.

San Jose, Ca, Us

●Protect company assets and ensure business continuity●Fraud and risk management●Work with architects and DevOpsSec to build the corporate application security program and develop secure software development lifecycle (SDLC) practices●Provide black-box and white-box web application/web service penetration testing services to large enterprise customers, partners, acquisitions, and Cisco●Present to technical management and senior executives●Develop and maintain methodologies and software tools to enhance Cisco penetration testing services and vulnerability management program.●Contribute directly to Cisco's knowledge management initiatives by documenting and briefing other Cisco DevOpsSec on lessons learned from engagements●PCI/PCI-DSS, SAS70/SSAE16/SOC, ISO auditing and compliance

San Jose, Ca, Us

●Conduct application penetration testing and assessments●Conduct wireless penetration testing and provide other advanced security services to Fortune 100 customersMade the impossible possible with a team of amazing and talented engineers

San Jose, Ca, Us

●Answer technical and procedural questions for less experienced team members and provide mentorship●Enhance and implement new processes●Determine security requirements by evaluating business strategies and requirements●Research information security standards●Conduct system security and vulnerability analyses and risk assessments; research architecture/platform requirements; identify integration issues; prepare cost estimates and project plan●Implement IPS/IDS technology for Cisco and customers●Automated security validation and assurance with test scripts●Monitoring to ensure compliance with standards, policies, and procedures; conducted event and configuration analysis●Developed and taught training programs●Enhance security systems by monitoring the threats and gaps●Prepare system security reports by collecting, analyzing, and summarizing data and trends

Patuxent River, Maryland, Us

NAVAL AIR WARFARE CENTER - WEAPONS DIVISION (NAWCWD) CENTER FOR ASYMMETRIC WARFARE (CAW)The Center for Asymmetric Warfare (CAW) provides testing, training, and experimentation support for Department of Defense expeditionary forces to prepare them to counter the effects of asymmetric warfare. We exercise large-scale "multi-agency, multi-level" events dedicated to supporting Homeland Security and supporting US and allied military forces to conduct Homeland Defense by recognizing, countering, and controlling the effects of terrorism, weapons of mass destruction, and information warfare.Asymmetric Warfare Initiative (AWI) is a major-centered homeland security exercise that exercises military, local, state, and federal authorities in a maritime/coastal terrorism context.I served as a technical administrator, adviser, and support for the Joint Information Operations Center (JIOC) during the AWI-04S exercise composed of the Federal Bureau of Investigation, US Coast Guard, Joint Terrorism Task Force, Department of Energy, Naval Air Warfare Center Weapons Division, Governor’s Office of Emergency Services, and Anti-Terrorism Intelligence Center, with a total of 60 agencies participating. Work includes planning, tabletop, and live exercises.