Mark Baseggio Email & Phone Number

Toronto, On, Ca

Remote, Toronto, Ontario

As Director of the Red Team at ServiceNow, I lead a team of expert security professionals in conducting risk-based attack simulations against our cloud software platform and other systems. My key responsibilities include:- Developing and executing attack scenarios that are aligned with business-relevant risks and prioritized based on their potential impact to enhance ServiceNow's security- Collaborating with the Blue Team in "Purple Team" exercises to improve detection and defense against real-world attacks.- Ensuring stakeholders receive high-quality reports and presentations that clearly communicate the organization's risk posture and next steps for risk reduction.- Tracking and reporting findings and remediation activities using a ServiceNow application I designed.- Ensuring the Red Team operates ethically and within the organization's risk tolerance levels.Additionally, I act as the technical program lead with several direct reports working on the next-generation ServiceNow instance security program. This program measures and manages the security of all ServiceNow instances.

Remote, Toronto, Ontario

As a Principal Red Team Engineer at ServiceNow, I was responsible for leading and conducting advanced penetration testing and simulated attacks against the company's cloud-based software as well as internal networks. Specifically, my role included:- Conducting thorough testing and analysis of various technologies, including web applications, network devices, and servers. - Developing a deep code-level understanding of the ServiceNow application and its supporting technologies.- Developing and executing risk-based comprehensive attack scenarios that mimicked real-world threats.- Providing guidance and recommendations to ServiceNow's security teams to help them address identified vulnerabilities and improve their overall security posture.- Staying up-to-date with the latest security trends, tools, and techniques to continually improve ServiceNow's security defenses.

Toronto, Canada Area

As a founding member of the internal Red Team at RBC, I was responsible for conducting advanced penetration testing and simulated attacks against the bank's applications, infrastructure, and systems. Specifically, my role included:- Identifying vulnerabilities and weaknesses in RBC's security posture.- Conducting thorough testing and analysis of various technologies, including web applications, network devices, and servers.- Developing and executing comprehensive attack scenarios that mimicked real-world threats.- Providing recommendations and guidance to RBC's security teams to help them address identified vulnerabilities and improve their overall security posture.Throughout my time at RBC, I worked collaboratively with various teams across the organization to ensure that all testing and analysis was conducted in a controlled and ethical manner. My work helped RBC stay ahead of potential threats and ensure the security and privacy of their customers' information.

Toronto, Canada Area

As a Principal Consultant at Mandiant:- I led and conducted Red Team engagements for clients across various industries.- I developed and executed realistic and advanced attack scenarios to test and improve clients' security posture.- I worked closely with clients to understand their unique security needs and developed tailored solutions to meet those needs.- Through these engagements, I helped clients identify vulnerabilities and provided actionable recommendations to strengthen their overall security defenses and reduce risk.Overall, my role as a Principal Consultant at Mandiant involved using my expertise in Red Team engagements to help clients improve their security defenses. Through my work, I was able to identify vulnerabilities and provide customized recommendations to address them.

Toronto, Ontario

As an independent consultant, I leveraged my extensive experience in the offensive security space to tackle challenging information security assessments through partners and direct clients. I developed close working relationships with many recognized names in Canadian and US information security by providing high-quality turnkey security services.I focused on and honed my skills in the following areas, enabling me to deliver comprehensive security assessments that met the specific needs of each client:- Red teaming- Network security- Social engineering- Physical security- Web applications- Mobile platforms and applications.Conference talks delivered:- Sector 2016, Getting Business Value from Pen Testing- B-Sides LV 2016, Megatouch Haxx

Toronto, Canada Area

I initially joined the Accuvant LABS (now Optiv) Attack and Penetration team as a Senior Consultant. In this role, I truly “cut my teeth” as an information security professional. While delivering on the team’s suite of offensive security offerings, I gained invaluable exposure to mature methodologies, best-practice deliverables and an incredible team of elite security experts—some of whom played a key role in the birth of the security industry.After aggressively absorbing knowledge and experience for over a year, I was promoted to the position of Principal Consultant. This position gave me the opportunity to begin contributing back to the practice, through mentoring junior peers and assisting in practice management activities. In this role I achieved the distinction of being in the top three performers for Q4 (the practice’s busiest quarter) and was consistently ranked among the highest performing consultants.During Accuvant’s merger with FishNet Security I was promoted to the position of Managing Principal and tasked with leading a team of 10 consultants (five of whom I recruited and hired). During the merger process I also played a key role in the delicate process of combing the teams’ practices and methodologies. I authored the Optiv Physical Penetration methodology which is in use by approximately 50 consultants, and had a hand in creating many of the tools and materials developed during the merger process.In my time at Accuvant LABS I performed security consulting work in over 10 countries, and in three continents. I delivered six conference talks and released open source tools into the security community.Conference talks delivered:- Blackhat USA and Europe 2015, Sector 2015: Breaking Access Controls with BLEKey- B-Sides 2014: Shut the Front Door (RFID Security / iClass cloning)- B-Sides 2013: Hardware Gone Wild (Hardware hacking) - Sector 2013: Beyond the Smoker's Entrance (Physical security)

Toronto, Canada Area

Working on a small professional services team taught me to be adaptable with clients and resourceful when problem solving.At Sentry Metrics I performed a diverse array of consulting work. From application and network security, to bespoke engagements such as wireless intrusion prevention (WIPS) testing across a deployment spanning a 2000-store retail chain. I was relied upon to help improve professional services processes, methodology and deliverables, while developing custom tools and mentoring junior technical resources.I worked closely with sales and management to help scope and sell work, which I would often also execute. Additionally, I assisted with resourcing, bringing in contractors to help with complex engagements requiring additional talent due to volume of work, or specific technical demands.Note: In August 2014 Sentry Metrics was acquired by The Herjavec Group.

2350 Matheson Blvd. E., Mississauga, On

Account management, sales and pre-sales focusing on wireless and mobile applications.

Toronto

Infrastructure design, system administration, and even some business intelligence with a few special projects thrown in to spice things up. Sears Hearing Centres run by www.hearforlife.ca

Greater Toronto Area

I acted as both a technical and business resource in this small security startup. One day I would be discussing scoping with a customer, or calling another about an invoice and the next I’d be heads down performing technical assessment work.Perhaps the most interesting technical work I tackled while at the company was a “bake-off” between the two most prominent IDS vendors of the day. We assembled and executed a test framework to test the detection/prevention effectiveness, management experience and traffic handling capabilities of each company’s device. Our work was used as to make a purchasing decision for a company planning a large global IPS/IDS rollout.

Toronto, Canada Area

Ran an association representing Ontario construction employers to the government; and offering a non-profit group-benefits plan to their employees. The organization has since been renamed Merit Ontario and can be found on the web at http://www.meritontario.com/

Toronto, Canada Area

St. Catharines, Ontario

Elected President and CEO of the Brock University Students' Union.