Alexandra Ulsh Email & Phone Number

Washington, District Of Columbia, Us

As the General Manager for Mapbox Atlas - the containerized self-hosted edition of Mapbox - I drive P&L, including engineering, product, operations, GTM strategy, and people management (3 SWEs, 1 PM). I am a member of the inaugural cohort of Mapbox GMs.* Achieved double-digit XX% CAGR from 2018 through 2020, reduced AWS hosting costs by 35% in 2020, and maintained 98% operationally green status according to service SLAs.* Launched 5 products in 2 years from private beta to GA: Atlas v2 aka Atlas for Docker Compose (Aug 2018), Atlas Search (Jan 2019), Atlas Boundaries (Jun 2019), the Atlas toolkit (Oct 2019), and Atlas for Kubernetes (Sep 2020).* Rolled out new commercial OEM (B2B2B/B2B2G) pricing in 2020 and signed first Atlas OEM customers in August 2020 and December 2020.* Shipped code protections and obtained a copyright for Atlas in 2019, enabling OEM contracts and entry into new geographic markets.* Implemented new tier, feature, and rate limit based pricing and packaging in 2018 and obtained GSA, SEWP, and SLSA listings in 2019-2020.* Hardened Atlas using the RHEL 8 STIG, ASD STIG, Docker CIS benchmark, and Web Server SRG for DoD RMF compliance for an ATO.* Engaged in 101 customer calls in 2020 and developed 5 customer demos for Atlas installation, vector data conversion, raster data conversion, elevation data querying, and satellite imagery.* Developed the Atlas installer CLI, updated the Atlas downloads API to support v2, and audited the security of downloadable Docker images as a backend engineer on the Atlas v2 tiger team from May - June 2018.

Washington, District Of Columbia, Us

I was the first full-time security hire at Mapbox. I joined shortly after Series B and worked in the Mapbox garage by 14th & R St NW.* Added XSS detection to company-wide eslint configuration (https://github.com/mapbox/eslint-config-mapbox/pull/3) that enabled detecting and fixing potential XSS findings for 5 public front end codebases and now runs on CI to prevent publishing new XSS vulnerabilities to mapbox.com.* Launched public bug bounty program (https://hackerone.com/mapbox) and security bulletins (https://www.mapbox.com/security-bulletins) covering 18 domains and products, including 4 open source SDKs, 11 public APIs, and 724+ public GitHub repositories.* Audited 4,904 existing public Gists for 177 employees (2017), developed Lambda + DynamoDB bot to monitor for new public Gists, and published private custom browser extension that warns before posting new public Gists.* Orchestrated successful SOC 2 Type 1 audit.* Audited 900+ public Google Drive files via self-service Google Apps script (https://www.alexandraulsh.com/2018/04/16/public-google-drive-files/). Developed AWS Lambda function to detect new public Drive documents and Slack DM document creators to confirm public status.* Decreased bug bounty average first response time from 4 days to 20 hours, reduced noise by 12.9%, and doubled resolved reports from 11.3% to 24.8% by developing HackerOne + GitHub AWS Lambda integration (https://www.alexandraulsh.com/talks/oreilly-security/).* Fixed XSS vulnerability in open source Mapbox.js library - triaged report, patched vulnerability (https://github.com/mapbox/mapbox.js/pull/1102), published build to npm, drafted disclosure bulletin, and requested a CVE (https://nvd.nist.gov/vuln/detail/CVE-2017-1000043).* Authored first acceptable use policy, designed first company security training, drafted 2FA guide, developed incident playbook for Node.js security patches, and devised method for securely open sourcing projects.

Reston, Virginia, Us

I was appointed as the acting team lead after the previous one left for another opportunity. While I was offered the team lead position on a permanent basis, I declined so that I could pursue an Information Security Engineer position at Mapbox instead. I temporarily managed a team of 3 SharePoint professionals (senior developer, junior developer, and trainer) while also executing as a systems administrator.

Reston, Virginia, Us

Client: Fort Belvoir Community Hospital, Information Management/Information Technology (IM/IT) department* Executed all hospital intranet operations supporting 38 servers in 4 environments (dev/test/staging/prod) and 6,000+ users in a 24/7/365 clinical setting.* Decreased security hardening process from weeks to 5 minutes by creating 4 PowerShell modules to automatically apply 30+ SharePoint, IIS, and SQL Server DoD security configuration settings (STIGs).* Achieved a 92% compliance rate for successful DoD ATO security audit, a 67% increase from 25% baseline, via PowerShell STIG scripts, 50+ page Site Security Plan (SSP), architecture diagrams, and total farm encryption.* Reduced deployment time from 10+ manual hours to 3 semi-automated hours for new SharePoint farms via VMware templates and PowerShell scripts.

Sub-contractor to Booz Allen Hamilton for the Project Management Office (PMO) of IPPS-A (Integrated Personnel and Pay System-Army - https://ipps-a.army.mil/), the world's largest deployment of Oracle PeopleSoft.* Administered 2 SharePoint 2010 farms, 1 ADFS 2.0 server, and 63 SQL Server 2008 R2 databases for 300+ internal program users and 150+ external stakeholders.* Achieved successful DoD ATO security audit by applying DoD security configuration settings (STIGs) to 2 SharePoint farms, 2 IIS servers, and 5 IIS sites and drafting SharePoint Site Security Plan.* Automated QA reports by programming 30+ JavaScript-based dashboards using the SharePoint REST API and external data from HP Application Lifecycle Management, Oracle, and IBM InfoSphere.* Enabled SharePoint access for 150+ external Army Reserve and National Guard stakeholders by configuring SAML SSO authentication via Active Directory Federation Services (ADFS).* Reduced processing time for Engineering Change Board requests from 1-2 weeks to 4-6 days and 0.5 days for emergency requests via InfoPath Forms Services.

Washington, Dc, Us

Transformed a manually maintained 300+ Outlook contacts list on the European Parliament into a centralized and automatically updated 1000+ database on Microsoft Dynamics CRM, accessible by the Ambassador via Blackberry.

Arlington, Virginia, Us

* Developed SharePoint sites and strategic communications for the Interactive Customer Evaluation, Installation Management Campaign Plan, and Installation Status Report programs.* Launched redevelopment of USAG Brussels Site Collection and redesigned landing page using SharePoint Designer, HTML, CSS, and JavaScript.

Washington, Dc, Us

Created 3 presentations on the emerging role of social media, mobile devices, Web 2.0, and Gov 2.0 in emergency response and disaster management for the U.S. Federal Emergency Management Agency Director’s NATO representative to brief at NATO committee meetings.

Arlington, Virginia, Us

* Constructed SharePoint recurring meeting workspace for the biweekly Command and Staff meeting, including PowerPoint slide library that enabled multiple people to edit the slide deck at the same time.* Led 2 SharePoint training workshops for senior leadership and the Garrison Commander.* Migrated the documents and records of each Garrison department from network file shares to SharePoint.

Washington, Dc, Us

Researched the military administrations of 28 NATO member countries and 22 Partnership for Peace countries. Used HTML, CSS, and JavaScript to update SharePoint site with research.

Bachelor Of Arts, International Relations

Mandarin Chinese