Brian C. Email & Phone Number

Chicago, Il, Us

I lead the AppSec program where I have created and manage a cross-functional Security Champions program focused on improving the security posture across the organization. The Security Champions program is based on OWASP principles and is leading results-focused initiatives to understand and meet PCIv4 compliance, modernize dependency and secrets management, build threat models and provide security focused training like regular CtF events with OWASP Juice Shop.I also am responsible for Security Operation tasks associated with bot management, risk management, improving policy, reducing fraud and performing incident response functions. Tools I use include Invicti Netsparker, SonarQube, AWS, Hashicorp Vault, Kibana/OpenSearch, Datadog, Akamai, HUMAN PerimeterX, ZeroFOX, BurpSuite, DockerHub, Jira, Git and Confluence.

Cybersecurity, AppSec, OSINT and fraud detection/management consulting as needed.

San Jose, Ca, Us

Information and Application Security. Integrated Uptycs across the business unit. Worked with Splunk, Tenable, Ansible, and Puppet.

Los Angeles, California, Us

Led AppSec program based on OWASP principles, including managing a Security Champions program and building threat models using OWASP Threat Dragon. Make use of SAST tools like SonarQube, FOSSA, WhiteSource Bolt and dependabot. Managed the organization's HackerOne program including researching issues and responding to security researchers. Managed firewall and rate limiting rules in Cloudflare.Built out a SIEM (Security Information Event Management) system using Splunk doing administration and building dashboards and alerts. Integrated Splunk with AWS and tools like Crowdstrike and Tenable. Involved with abuse and fraud prevention using tools like Splunk and Sift.

Chicago, Il, Us

Particular focus on developing AppSec best practices based on OWASP principles methodology throughout the software lifecycle. Championed a new Application Security architecture review process used across the organization. Conduct security consulting and security review of cloud (primarily AWS), web, desktop and mobile assets across Morningstar.Built out SafeNet HSM and KeySecure crypto technologies. Worked with Cybereason IDR tools (Incident Detection and Response), log forensics/monitoring with Splunk, Checkmarx SAST and Open Source dependency checking, threat modeling and vendor relationships.

Riverwoods, Il, Us

SIEM (Security Information Event Management) administration, rule implementation, behavioral analysis and fraud prevention using RSA Web Threat Detection. Particular focus on technical development (SIEM rule definition, Splunk and script automation) and consulting with fraud project teams across Discover to define and establish risk thresholds.

Chicago, Il, Us

Architect and lead developer on the Groupon Online Defense project, a SIEM tool used to monitor, analyze and respond to malicious users and bots. Technologies included Splunk, an nginx plugin written in C, a Web interface written in coffeescript/Bootstrap.js/Backbone.js, and ruby.Involved with supporting the PCI servers and ensuring compliance.

Us

Served on the GNOME Foundation board of directors for four terms (1/2008-6/2012). Served last term as president, two previous terms as secretary and the first term as director. Member of the GNOME Foundation from 2002 through 2014. Maintainer of the GNOME Display Manager (GDM) login application since January, 2005.

Austin, Texas, Us

Senior engineer and Security-Point-of-Contact on the Solaris Userland team responsible for most free and open source software in the Solaris operating system. Personally responsible for modules such as Perl, Python, and Tcl/Tk, including tasks such as integrating Python 3 and associated modules into Solaris 12. Responsible for monitoring and responding to security advisories.

Austin, Texas, Us

Systems Security Lead responsible for establishing security policy and procedure across the Oracle Systems organization which included the Solaris operating system and many hardware/firmware products acquired by Sun Microsystems.Worked closely with project teams across the Oracle Systems organization to ensure adherence with Oracle's formal security policies including reviewing and approval of security documentation, working with teams to minimize their threat landscape, approving waivers when policies could not be fully met, and holding teams accountable to resolution plans. Most significantly, I was responsible for the security approval process of the Solaris 11 & Solaris 10 update releases.Developed the security review process for free and open source software used across Oracle Systems

Austin, Texas, Us

Continuation of my role as Principal Software Engineer on the Solaris Desktop Systems team.

Palo Alto, Ca, Us

Member of Sun's Architectural Review Committee (PSARC and FWARC). GNOME Desktop engineer on the Solaris Desktop Systems team. Responsible for many aspects of developing and supporting GNOME Desktop and FreeDesktop functionality on the Solaris SPARC and x86 platforms including custom code for the Sun Ray thin-client. Development work was primarily in C, python and build autotooling. Particular focus on security including implementing key Trusted Path desktop components of Solaris Trusted Extensions, the GDM login program, and the xscreensaver lock screen. Responsible for completing export control documentation across the Solaris Desktop organization.Considerable experience with accessibility and “Section 508” law. I implemented portions of ATK (Accessibility ToolKit) and libgail providing accessibility features for the GTK+ widget set and in the GDM application and co-authored the “GNOME Accessibility for Developers” guide. Note that the ATK and libgail code I worked on has since merged directly into the GTK+ library. Lead engineer for Solaris Desktop Media. Integrated GStreamer, PulseAudio and multimedia features into Solaris. Experience doing development closely with kernel and driver developers. For example, integrating Desktop support for login device permission management, authentication, auditing, X11, OSS (Open Sound System), SunAudio, HAL (Hardware Abstraction Layer) for filesystem access, and mediaLib MMX/SSE/VIS chipset hardware acceleration in GTK+. I also did some work fixing X11 related bugs in the CDE (Common Desktop Environment).

Palo Alto, Ca, Us

Technical lead for integrating the Xmerge project into OpenOffice, a Java project that converts documents between OpenOffice and small device formats (Palm, Psion, PocketPC). Designed the XmlFilterAdapter interface for StarOffice XML-based conversion. I received 3 patents for these technologies. Transitioned back to GNOME once the project was successfully integrated.

Palo Alto, Ca, Us

Senior engineer on the Sun Management Center 2.1.1/3.0 project. Responsible for the console layer of the application, written in Java Swing. Contributed to the design and implementation of the Module Builder, an application for writing SNMP modules. Implemented integration with Computer Associates Unicenter-TNG 2.2.

Chicago, Illinois, Us

Led a team of four engineers working on a suite of applications written in C and C++ and used by data entry clerks to view & edit credit data using VT100 terminals connected to an IBM AIX server. Built many utilities with Perl including UNIX source code control management and building software with Makefiles.

London, England, Gb

I worked for Amoco Oil Company before the merger with British Petroleum. Developed linear & non-linear math analysis tools written in C and C++ running on Solaris. Developed table editing, data visualization, linear math operation and reporting tools for multi-dimensional tables which were used to optimize & schedule operations at petroleum refineries, chemical plants & pipelines. Built many utilities with Perl and shell scripts including source code control management and building software with Makefiles. Provided technical support to end users.

Ms, Computer Science

Bs, Computer Science