Andy R. Email & Phone Number

Waterloo, Ontario, Canada

Responsible for the security technical direction of multiple projects. Research and determine high level design choices specific to the security aspects of the software structure, frameworks, protocols, and algorithms. Determine secure best coding practices, development tools, and validation requirements. Interact with multiple technology SME's in the company and within the industry as well as between developers and project managers to evaluate feasibility of requirements and determine priorities for development.

Waterloo, Ontario, Canada

Analyze software applications for security vulnerabilities, recommend mitigation techniques, and consult as an application security expert. Assist Product Security Management in designing and documenting policies, process, and procedures to continuously improve and track our Product Security Assurance Program, governing testing and scanning procedures in a Secure Development Lifecycle.▪ Perform application layer security vulnerability assessments and penetration tests, exercising expertise with SAST and DAST tools and methodologies.▪ Investigate reported vulnerabilities, provide information about defect types, document steps to recreate, assess exploitation likelihood, impact, risk, etc.▪ Work closely with product development teams to assess and improve the maturity of security vulnerability detection procedures and mitigation.▪ Initiate threat modelling exercises, paper based security assessments, audits, application security architecture reviews;▪ Threat and vulnerability management, research, internal dissemination and tracking of risks.▪ Train, mentor, and support.▪ Author clear, concise and unambiguous reports and technical whitepapers, and perform peer reviews, offering constructive criticism of other team member’s outputs.▪ Liaise with customers on security assurance needs and issues.

Waterloo, Ontario, Canada

▪ Regularly perform penetration testing and vulnerability assessments.▪ Responsible for risk management of internal/external hosted vendor selected applications.▪ Security SME in the areas of Vulnerability Management and Security Compliance.Helped drive the completion of PCI V3.1 compliance across UW campus. Performed PCI training and awareness. ▪ Responsible for the architecture and continuous improvements of a secure, segregated, and scalable environment in order to meet the compliance demands of PCI.

Toronto, Canada Area

Conducted Web Application Penetration Testing and Vulnerability Assessments.

Waterloo, Ontario, Canada

• Planned, developed and executed vulnerability assessments against network perimeter and web applications. • Performed infrastructure vulnerability assessments at enterprise level, contract manufacturer, acquisitions and merger companies.• Responsible for writing timely vulnerability assessment reports to management andStakeholders• Maintained operational support of enterprise vulnerability and configuration assessment tools and ensured the scheduled scans completed on time.• Lead source code reviews providing recommendations to fix flaws that lead to security vulnerabilities.•Engaged with multiple teams including security architecture and project management, Security Operations Center, Security Applications Support, BlackBerry Security, and Compliance Risk Management to align compliance expectations of vulnerability assessments.• Acted as subject matter expertise for developers and direct operational staff in improving security. • Wrote formal Vulnerability Management related policy and procedure documents• Raised awareness of Vulnerability Management program in critical areas of the company.• Communicated security principles to large audiences through training and awareness• Platform hardening of new computer hardware / software and operating systems. • Engaged with BlackBerry security incident response in the resolution of external vulnerability notifications. • Capable of analyzing large amounts of disparate data to produce easily understandable content.• Established matured Corporate Security Vulnerability Management program.• Gathered, analyzed, scored, notified and follow up on vulnerabilities. • Chaired monthly patch Tuesday Vulnerability Management meeting to discuss recently disclosed vulnerabilities with key stakeholders.• Broad understanding of the BlackBerry security Governance structure and provided recommendations on deficiencies related to Vulnerability management

• Architected multi-platform server hardware and OS environments to allow for rapid expansion and optimized efficiency. • Developed scripts to meet benchmark and baseline performance.• Provided subject matter expertise to several IT and R&D groups in the areas of hardware, storage, networking strategies and configuration. • Developed best practice process and procedures for evaluating, deployment, maintenance and optimization of engineering systems.• Monitored system performance and usage, identified potential issues prior to deployment and developed and executed necessary preventative actions.

• Reviewed and approved multi-region maintenance change requests, generated forward schedule of change reports, identified potential conflicts, coordinated efforts to reschedule conflicting maintenance • Chaired Global Change, Pre-Approved Change and Conflict Resolution meetings on a rotational basis.

Waterloo, Ontario, Canada

• Diffused escalated issues from the IT Service Desk • Diagnosed and repaired software related problems both locally and remotely• On call support for Tier 2 escalated issues from Service Desk. • General maintenance on the LANDesk SQL server database, deleted ghost accounts; removed duplicate name or PC entries, making sure critical system services were running.

• Responsible for administrating and maintaining 250 PC/Laptop’s in a Windows 2000 AD environment. • General maintenance of IBM E-Series servers as well as a large amount of printers/scanners/faxes/copiers. • Worked daily with Active Directory to add/remove users/groups; set user and group permissions; created and implemented group policy objects related to enhancing client security.• Designed and implemented a test procedure for a wireless (802.11b) Intermec hand scanner inventory system as well as rolled out physical access points and secured environment.• Helped with implementing / starting an open source Linux based ticketing system (Request Tracker) for organizational purposes. • Maintained and tested regularly VERITAS tape backup system for company-wide domain (including satellite offices).