Cameron W. Email & Phone Number

Wakefield, Ma, Us

Co-Leader of OWASP Project SPVS (Secure Pipeline Verification Standard).The SPVS is a detailed guide containing a robust set of controls designed for software engineers, DevOps/DevSecOps engineers and security teams. It aims to assess and enhance the security maturity of software development pipelines, with a focus on managing the risks associated with code and artifact handling throughout the entire pipeline lifecycle, from inception to delivery.

San Diego, California, Us

San Diego, California, Us

Tech Stack: Snyk (SAST, SCA, IaC, Container), ArmorCode (ASPM), Invicti (DAST), Secure Code Warrior, GitGuardian, Prisma Cloud, Synack, GitHub, GitLabLanguage Stack: Java, C/C++, Python, Go, Javascript, Typescript, Terraform● Established a global Application Security team in the US & India, enhancing global security operations through strategic collaboration and hiring● Revamped SAST, DAST, SCA, and Developer Education processes, reducing vulnerabilities in flagship products by 90% through best practices and automation● Led code review sessions to improve developer security posture, halving initial code review security flaws through hands-on teaching● Executed strategies to enhance Application Security efficiency, achieving an improvement through analytics and automation● Developed metrics for risk and security trends with ASPM, resulting in a reduction in security incidents via proactive management● Formulated a comprehensive, multi-year Application Security strategy, mitigating strategic risks and securing enterprise assets● Identified and closed 300% more security code coverage gaps, significantly bolstering the security code base with advanced scanning● Strategized with Product Engineering to drive 'Shift Left' security scanning, improving detection and remediation efficiency● Implemented a process to eliminate new vulnerabilities and reduce old ones, reducing vulnerability by 90% in a year● Overhauled SAST & SCA tooling in line with cloud strategies, streamlining security processes for better cloud native alignment● Centralized Application Security metrics into a single dashboard, enhancing decision-making efficiency.● Enhanced the software penetration testing program, setting a higher security standard across software products● Elevated secure developer training, with 97% of developers meeting quarterly goals, fostering a security-first culture

San Diego, California, Us

Tech Stack: Synopsys (SAST & SCA), Netsparker (DAST), Secure Code Warrior, SynackLanguage Stack: C/C++, Java, Go, Python● Deployed Pentesting-as-a-Service with Synack, introducing advanced security testing to identify and mitigate vulnerabilities efficiently.● Assisted in overhauling the Application Security program, integrating SAST, DAST, SCA, along with developer education & policies to strengthen security frameworks.● Implemented a developer education program using Secure Code Warrior, elevating coding standards and security awareness across development teams.● Conducted threat modeling sessions with developers on key cloud components, fostering a proactive approach to cloud security and risk management.

Irvine, California, Us

Tech Stack: Veracode (SAST & DAST), WhiteSource (SCA), Synk (IaC & Container), BurpSuite, GitLabLanguage Stack: C++, C#, Javascript, Python, Go, Java● Built out an Application Security program, incorporating SAST, DAST, SCA, Developer Education, & Policies to fortify security measures.● Led the integration and management of Veracode (SAST, DAST) and WhiteSource (SCA) across all production CI/CD pipelines, enhancing security automation.● Rapidly integrated Synk’s IaC and Container Security within CI/CD pipelines, achieving full deployment in a month and bolstering infrastructure security.● Streamlined Application Security tooling integration, reducing setup time from hours to 20 minutes and implementing centralized template scanning for widespread impact.● Directed a project to analyze and address root causes of prolonged application scan times, identifying key inefficiencies.● Reduced scan times for a large monolithic application by 97%, significantly improving efficiency in security operations.● Achieved a 95% reduction in security vulnerabilities within a monolithic repository in one quarter, demonstrating effective vulnerability management.● Contributed expertise in multiple Mergers & Acquisitions, assessing Application Security risks and ensuring informed decision-making.● Collaborated with developer teams on Application Security tooling findings, facilitating timely and effective remediations.● Assisted in replicating and remediating customer & Pentest vulnerability findings, enhancing product security and customer trust.

Irvine, California, Us

Irvine, California, Us

Tech Stack: Tines.io (SOAR), Synopsys Polaris (SAST), OWASP Dependency Track (SCA), Acunetix (DAST) Jenkins, Groovy, AWS, EDR/EPP, Splunk (SIEM), Tenable.io, Secure Code Warrior● Assist in implementation and development of Application Security pipeline using Synopsys Polaris, Assisted in developing the AppSec pipeline, integrating Synopsys Polaris, Jenkins CI/CD Groovy Pipeline Library, and OWASP Dependency Track within AWS, enhancing security automation and compliance.● Utilized SOAR to automate AppSec processes, triggering Jenkins automation upon Bitbucket repository commits/pushes, streamlining security checks.● Onboarded Bitbucket repositories into the AppSec Jenkins CI/CD Groovy Pipeline Library, significantly improving the integration and security scanning processes.● Partnered in a Pentest audit of the Authorization process, focusing on user account login via OAuth and OIDC, identifying critical security improvements.● Conducted a Pentest on a Mobile application using Android Studio and BurpSuite, assessing OAuth and OIDC flows, and enhancing mobile application security.● Collaborated with developer teams to remediate AppSec detections, ensuring vulnerabilities were addressed promptly and efficiently.● Assisted in developer security awareness training with Secure Code Warrior, elevating the security knowledge and practices of the development team.

Irvine, California, Us

Tech Stack: Tines.io (SOAR), EDR/EPP, Splunk (SIEM), Umbrella, InsightVM, Secure Code Warrior● Identified areas for security tool improvement through automation, laying the groundwork for enhanced security operations.● Built automation using SOAR for security-related tools, streamlining responses and increasing efficiency.● Developed automation to analyze suspicious emails for indicators of compromise, enhancing early threat detection capabilities.● Created automation for EDR Detections analysis and action, improving response times and reducing manual intervention.● Managed an EDR PoC, evaluating leading solutions to align with company and business goals, guiding strategic security decisions.● Led the deployment of a new EDR solution, CrowdStrike, replacing SentinelOne across all systems, optimizing endpoint security.● Managed, implemented, and debugged the CrowdStrike EDR solution on 3000+ systems, ensuring comprehensive protection and system integrity.● Integrated threat intelligence into security tools such as CrowdStrike, Umbrella, and Splunk via SOAR, enhancing threat visibility and response.● Assisted in PCI-DSS Level 1 audit, contributing to audit planning and security-related documentation, supporting compliance efforts.● Promoted Secure Code Warrior program awareness, increasing visibility to Application Security and fostering a culture of secure coding practices.

Tech Stack: PowerShell, Python, Backlog, Jira, Windows Client/Server, Visual Studio Code● Developed test plans and procedures to validate software requirements against customer specifications, ensuring alignment with client needs.● Built a testing lab & unit farm using desktops/laptops for efficient regression testing, significantly enhancing testing capabilities.● Created automated test scripts, cutting the test cycle from 1 month to 5 days, drastically improving efficiency.● Integrated data analytics into automation, establishing a trackable history for enhanced test analysis and reliability.● Executed manual test cases, providing ongoing maintenance and development of bug fixes to maintain high software quality.● Analyzed and reported test results, documenting bugs comprehensively with replication steps, facilitating swift resolution.● Worked closely with developers to verify results, troubleshoot, and remediate bugs identified through automation testing, fostering a collaborative approach to quality assurance.● Replicated customer-reported bugs and debugged issues in the testing lab alongside developers, enhancing product reliability.● Tracked bugs reported by partnered companies using JIRA, maintaining clear and organized communication channels.● Installed and managed the company’s bug tracking system with the Backlog ticketing system, streamlining issue tracking and resolution.● Managed the company’s Software Penetration Test with a third-party vendor, ensuring the product's security and compliance.

Mettawa, Il, Us

Tech Stack: C/C++, CSS, HTML, JavaScript, Jenkins, Git, JIRA, Eclipse IDE, Visual Studio Code● Served as a team member on Tools & Infrastructure and Operating System teams, focusing on developing quality embedded software, contributing to core system enhancements.● Overhauled nightly regression testing into web-based reports with Jenkins, streamlining the reporting process and enhancing accessibility for the development team.● Developed a plugin to integrate a 3rd party requirements management tool into JIRA, facilitating better project management and requirement tracking.● Built a dynamic manual page in the ventilator’s operating system, generating real-time manuals for each command using pointers and templates in C/C++, significantly improving system documentation and user support.

Master Of Science In Cyber Security Operations And Leadership, Cyber Security

Bachelor Of Science (B.S.), Computer Science