I was brought to Dragos to build the product security business function from scratch. To expand the reach of the product security team, I also built out a security champions program that utilizes a developer from each product team. This alignment allows for strong contextual expertise on the codebase to triage security findings and quickly remediate issues. Among other accomplishments, I built the Product Security Incident Response Team (PSIRT), which led to a streamlined workflow enabling submissions to be triaged in fewer than three hours.

Servant Leader

Integrate security controls into the SDLC for predictable and reproducible testing at all gates of development. I was brought on board for my experience and expertise in building a Product Security / Application Security team from the ground up.- Led efforts in proof of concept through procurement of security vendor's tools.- Ran the Bug bounty program, leading efforts in triage and mitigation- Led the implementation and relationship of vendors for SAST, DAST, and SCA to cover software vulnerabilities from the inside out.- Established relationships with legal to ensure onboarding of vendors and products meet rigorous standards.- Collaborated and coordinated between GRC-P and product leadership to ensure security controls meet corporate and legal policies- Periodic and ongoing Penetration testing, Manual and Automated, through DAST CI/CD integration

Embed with Engineering teams to ensure secure software development. Work as the security expert on my products, ensuring corporate security controls are working as designed and that security requirements are provided to the team before coding begins.- Full stack security review from inception to deployment- Periodic and ongoing Penetration testing, Manual and Automated, through DAST CI/CD integration- Led efforts on Threat Modeling, Software Composition Analysis, Static and Dynamic Analysis, and implementing Secure Coding Guidelines.- Implemented organization-wide security controls that reduced infrastructure security risks from ever reaching production code through the use of Infrastructure as Code security tooling

Developed and executed information security processes to secure 10 of the nation’s critical infrastructure locations. Deliver effective leadership and guidance to a team to support minimizing exploits found in common malware; evaluate and improve the security of systems and devices.- Led a team of 8 direct geographically dispersed reports, facilitating and solving security and IT challenges and delivering projects and goals on time.- Doubled the remediation of actionable threats by monitoring security efforts across the entire organization and effectively taking action to mitigate them.

- Intimate working knowledge of OWASP top 10 and the 20 CIS controls.- Built and facilitated scalable work from home environment for employees by migrating business from legacy on premise infrastructure to fully cloud environment in less than 3 months.

Managed network testing tool development process to test and improve network integrity / viability of legacy installations. Established and maintained a CI/CD pipeline. Created machine learning algorithm as well as hardware and software to support the largest telecommunications company validate customer’s network.- Led the development of a novel network testing tool utilizing commodity hardware and open-source software.- Developed a REST API around iperf3 network testing application to make a highly scalable distributed network speed test.- Full stack development experience implementing highly intuitive UI with sophisticated back end architecture to be self healing and self-reporting.- Integrated CI/CD pipeline to automate deployment of security patches and feature updates in a seamless and secure fashion.- Achieved 55% decrease in repeat tech visits by leading and guiding corporate IT and Security team.- Enabled 100% successful software patch deployment through continuous delivery

- Developed and published wireless driver for Linux kernel (https://github.com/brandon-bailey/rtl8822bu)- Develop Dynamic Web Applications using JavaScript / jQuery, Ruby, Python, and PHP- Develop custom Linux operating systems for embedded systems- Establish and Maintain Software Development Lifecycle- Ensure the security of web applications and API's- Developed machine learning algorithm that utilized facial recognition to integrate with existing camera systems to control and monitor access to facilities- Integrate onsite applications with cloud-based environments such as AWS and Google Cloud - Developed hardware and software to help the largest telecommunications company to validate customer’s network

Served as an Infantry Sniper / Team Leader, directing deployment and employment of personnel; interpreted, and collected intelligence information; distributed administrative and training documents; trained subordinate personnel.