Chris Schwarzer Email & Phone Number

Boston, Ma, Us

Boston, Massachusetts, Us

Building secure software and architecture practices in cloud and hybrid data center infrastructures (AWS and Azure) for the athenahealth platform serving 16,000 providers and 160 million patients. Secure development lifecycle (SDL) practices implemented across large diverse global engineering teams to enable and mature their delivery capabilities. We measure ourselves with a set of metrics which include BSIMM. The SDL activities include architecture review, threat modeling, static and dynamic code analysis, SCA, infrastructure as code, pen testing, negative security testing, responsible disclosure, secure coding education and awareness programs in product and engineering teams. We have implemented a scaled, peer based Security Architecture Review capability globally based upon a quantitative analysis of architecture design elements supporting a release gating mechanism and shifting this into the engineering organization. Currently implementing the High Priority Security Issue program prioritizing exploitable business impacting vulnerabilities onto teams backlogs for remediation reported into the executive leadership team. Enhancing the Software Supply Chain controls but modernizing our approach and putting the controls closer to the engineering systems and tools. This included a binary repository for open source and container management, a Software Bill of Materials (SBOM), integrated validation of the build components to protect against malicious code injection and binary tampering.

Boston, Massachusetts, Us

Building the software and architecture security practices in the cloud and on premise data center infrastructures (AWS and Azure) for the athenahealth platform serving 160,000 providers and 100 million patients. Secure development lifecycle (SDL) practices being defined and implemented across large diverse global engineering teams to enable and mature their delivery capabilities. These include architecture review, threat modeling, static and dynamic code analysis, SCA, pen testing, negative security testing, responsible disclosure, education and awareness programs. Scaling a peer based Security Architecture Review capability globally based upon a quantitative analysis of architecture design elements supporting a release gating mechanism and shifting this into the engineering organization.

Jacksonville , Fl, Us

Leading a global team of security operations professionals focused on growing and maturing the security operations and engineering practices at EIGI. Engaged in information security operations, response and architecture focused on maturity and program growth, developing the capabilities of the teams and organization including PCI.Successfully built an information and application security program including an agile secure development methodology (SDL) centered on integration with engineering teams, leveraging automation, vulnerability management, consultative engagements and development of standards including development methods, education and practices. Measured the maturity level of the programs with the BSIMM to build metrics and gauge progress.♦ Developed an innovative approach and architecture to privacy breach detection and response to meet GDPR requirements♦ Developed a data classification scheme based upon the Veris Taxonomy.♦ Performed a cyber-security maturity assessment for the organization and increased Cyber Security maturity ♦ Developed a cyber-incident playbook. ♦ Built an AWS Security Framework in concert with the cloud team.♦ Deployed a SEIM - security event and incident management tool.♦ Operated a penetration program leveraging automation and manual facets.♦ Ran a vulnerability management across the organization via the cloud and a security center.♦ Deployed advanced endpoint protection. ♦ Delivered an evolving Security Strategy document based upon the needs and capabilities of the organization

Jacksonville , Fl, Us

Leading infrastructure security for global web hosting , SMB marketing and SaaS solutions delivery team building and maturing the IR, detection and architecture practices in a collaborative approach and using agile techniques. ♦ Delivered a Software / Product security program ♦ Delivered a secure development lifecycle and training to engineering teams in a self-service model. ♦ Created threat models for the evaluation of key infrastructure components.♦ Developed data flow and network diagrams for PCI environments. ♦ Overlayed SDL onto agile engineering teams, included backlogged stories for the teams and regular sprint activity tasks to keep the activities associated with the SDL light, current and updated. ♦ Delivered automated security practices to enable timely response to the business and engineering♦ Delivered architectural design review training to the architects and engineers including data flow diagram training ♦ Delivered cryptography and key management standards amongst others♦ Leveraged Docker within a POC with engineering teams providing fine-grained application security controls. ♦ Built and partially outsourced an external security vulnerability response program for external researchers and customers♦ Delivered metrics on security programs♦ Delivered an agile backlog of key security tasks providing visibility, resources required and measurable progress♦ Delivered an evolving Security Strategy document based upon the needs and capabilities of the organization

Waltham, Ma, Us

Technical security leader who owns and drives security-related technical designs and direction with an understanding of how to design, build and create secure, functional applications and API's using current design and development and tools including automation. Integrating Secure Software design and Architecture into an agile based engineering organization that is embracing DevOps, rapid change and virtualization based upon OpenStack using Puppet measuring with BSIMM based maturity measurementsSecurity in big data analytics using hadoop and cassandra delivering information to the business in a secure, role based methodologyFocused on authentication, role management, key management, audit/log, cryptography and the right protocols / network deployments and capabilities including O-Auth based secure authorization in a simple and standard method from web, mobile and desktop applications i.ncluding DockerDelivering training and guidance for teams in secure development providing rewards and recognition programs and direct feedback. Developing content and learning that leverages diverse learning channels for engineering, QE, architecture and product owners.Building Secure Development Lifecycles that embraces automation, intelligence, response and lightweight process's using risk based analysis and engagement in the development and operational processes that evolve as the engineering, operations and business does.Using Agile / Scrum in SAFe to work with the Engineering teams and manage the overall work product delivery mechanism for the company. Building out automated static analysis code analysis engines, the automation of BlackBox testing frameworks using dynamic code analysis and a innovative penetration testing programs leveraging small engagements to validate design and implementation principles as well as leveraging croud-sourced pen tests, incentivizing the engineering teams to reduce the number of defects found by external testing engagement.

Boston, Massachusetts, Us

Principal Security Engineer / Consulting Engineer / Software Engineer Highlights ♦ Integrated security as a consistent discipline; built a lightweight process and functions which defined the stage gates and requirements for projects ♦ Performed architecture review for IT projects with security as an integrated component. ♦ Delivered relevant information on security guidelines, specifications, best practices and how-to guides; such as crypto guidelines, Jira integration guidelines and a common threat library. ♦ Built global security advocate team across 9 countries and 16 locations.♦ Responsible for Information Security, software security assurance, vulnerability management and architecture reviews globally.♦ Developed a Cloud (IaaS, PaaS, SaaS) security assurance program, encompassing an information security risk assessment methodology and ratings system for tracking risk and status. ♦ Developed globally handheld, mobile and tablet security policies. ♦ Product Security Engineer for global engineering teams, led penetration test engagements, performed static code analysis, web application testing, vulnerability management, secure coding practices and remediation of defects. Defined architecture and systems for classification of data across multiple data repositories.

Boston, Massachusetts, Us

Product Security Architect / Engineer for global engineering teams insuring a base security standard is met for product development in both SaaS and licensed product offerings. Led penetration test engagements, static code analysis, web application testing, vulnerability assessment and management, secure coding practices and remediation of defects. Deployed Global Security Advocate program for engineering teams to develop secure coding and quality assurance skills with automated tools and technologies. Systems/Solutions Architect with a focus on SaaS, cloud storage, service definition and data classification bringing data management and information lifecycle management capabilities to market.Defined a standard for integrating multiple cloud providers in a standards-based approach, as a member of the SNIA Cloud Data Management Interface technical working group.♦ Developed the following:● a Virtual File store, a cloud-based storage offering in two geographic data centers, 70 + customers and 500TB● a vendor neutral archive strategy for Medical Image Archiving 50+ customers and 300TB● multiple 3rd party integration capabilities including F5● Service Level Agreements (SLAs) measurements and reporting for both functional and non-functional service agreements tied to metrics● Innovative large capacity data shuttle with a chain of custody for large data movements in excess of 120 TB ♦ Led / engaged the following:● deployment of customer onsite SaaS appliances in three different configurations● a four-person offshore deployment team ● an engagement with a large German-based financial institution for an enterprise storage opportunity● Deployment of infrastructure to support SaaS based application in multiple geographic regions Experience with Midcap and Fortune 500 companies presenting to both prospects and customers. Currently hold a Secret Clearance and CSA Certified Cloud Security Knowledgeable.

Boston, Massachusetts, Us

One of the founding employees to launch the Iron Mountain Digital services group within Iron Mountain. Build and deployed cloud based image management systems both in a demand and subscription model. Architected and deployed a cloud based outsourced email archive for SEC 17-a4 compliance storing multi-billions of emails for 100's of customers

Entrepreneurial consulting practice focused on Financial Services Imaging and Document management systems, specifically on and off shore Private Trust Management systems and the management of trust system data in an electronic format.

Systems engineer working on Automated Teller, Trust management, International Private Banking and Image management systems across a broad base of markets both domestically and internationally.

Software developer for multiple customer based packaged systems.

Bs, Finance

Education record