Architecting user-visible security features in Citrix Workspace and ADC.

Lead architect of AppDefense, VMware's hypervisor-supervised whitelisting security product. Re-architected its hypervisor supervision to improve privilege separation. Architected DNS whitelisting to augment existing IP address whitelist.Re-architected NSX's hypervisor-to-hypervisor encryption product to use TLS and operate guest-to-guest, for compatibility with industry TLS usage.

Security Technology Group, CTO Office, 2015-Sep 2016:Responsible for 3-5 year architecture of service provider security. Researched impact of TLS, TLS 1.3, and HTTP/2 to our network inspection products, and worked with engineering and customers creating innovative new features that leverage those changes.Standardizing DDoS signaling protocol for our router and firewall products to alert when suffering DDoS attack. Architected Cisco's service provider 3-5 year security strategy. Several group and one-on-one presentations to service provider customers explaining how to mitigate TLS impacts to their existing business practice.Refined innovative QoS protocol which is deployed on Cisco Spark (VoIP) and Cisco access points.Architected firewall traversal for both Cisco Spark (WebRTC) and QUIC, and suggested enhancements to those protocols to Cisco and Google engineers so those protocols can provide more robust firewall traversal.Sponsored university research on IPv6 privacy and multipath TCP.Security Technology Group engineering, 2012-2015:Responsible for NAT64 product features.Standardized and deployed Port Control Protocol for host-to-network communication with firewall, NAT64, and NAT44 devices to control their mappings. This protocol is deployed by two Cisco carrier grade NATs and by Apple iOS and OS X. Presented benefits of multipath TCP (MPTCP) to several service provider customers.Enterprise routing group, 2009-2012:Co-chaired standards group responsible for NAT64 and DNS64, and worked with engineering to deploy into our products. Co-authored Happy Eyeballs to improve dual-stack IPv6/IPv4 behavior. This is deployed by Safari, Firefox, Chrome, and others. Modeled how this technique impacts NAT44 load for Cisco customers.Designed and deployed cryptographic token firewall traversal mechanism, for disjoint signaling and media paths.

Enterprise routing group, 2006–2009:Improved VoIP security by improving and standardizing SRTP, EKT, and DTLS-SRTP. This required working with engineering and industry to build consensus and deploy those standards in our products.Voice Technology Group, 2001–2006:Responsible for architecting, coding, and standardizing fax over email (T.37) into Cisco IOS routers.Architected protocol design of MGCP and VoIP for our GR303 gateway acquisition.

Fax over email, wrote SMTP client and server for Cisco IOS, standardized ITU T.38. Consumer voice product, VoAAL2.

Co-chaired IETF working group that standardized NAT64 and DNS64 technologies for IPv6 transition, NAT/NAPT behavior, and NAT traversal protocols (STUN, TURN, PCP). Authored several documents related to these technologies and influenced road-map to include those protocols.

Software engineer MultiNet Windows telnet client, technical support for MultiNet TCP/IP customers, consulting, Windows build engineer. TGV was acquired by Cisco.

System administrator of patient billing system. Interfaced with database software vendor using HL7 and resolved system and network performance issues.