David Cross Email & Phone Number

Dunwoody, Georgia, Us

Finding and mitigating risk. Recommend solutions and technologies.Safely employing local and remote AI models to enhance Red and Blue teaming.

Los Angeles, California, Us

Security program strategy, compliance, AppSec management.Pen-testing, static and dynamic scanning. Cloud testing, threat hunting.General techno-wizardry to solve things that need solving. Automation with Selenium and AI.Actively developing next gen AI solutions for interactive use and security. As an early adopter of GPT I was granted early access to 3, 4 and 4-8k. I found that GPT could do much more than what was described in the documentation. Prompt whisperer, prompt hacker.Testing and driving improvement for cutting edge 3d user-driven world design and the other incredible things Magnopus does.Chosen to create the AI Village for Saintcon 2023 and presented at Storymakers and AI panel member with ISC2.

American Fork, Utah, Us

Worked with global CISO and C-suite to resolve issues including legal, technical and risk. Resolved issues with agencies and governing bodies. Resolved tens of millions of dollars in risk. Managed security for cloud and software across product lines and disciplines.Performed Cloud and on-prem security testing, auditing and security automation. Researched new security technologies, partnerships, methods and hacking techniques. Scoped and managed 3rd party audits. Provided SSDLC guidance and policy as well as automated static and dynamic testing. Researched and prepared decision documents to weigh options and establish common rationale and stakeholder buy-in. Grew and matured processes and capabilities. Performed threat analysis and remediation. Consulted with product leaders and development teams to give direction on application-related web, cloud and PKI security design and implementation. Threat hunted, and created SEIM reports and scan automations.Contributed to the hacking community via conference presentations and by writing security tools. Volunteered for NIST, InfraGard, UtahSec and currently am a board member of the Cyber Security Collaboration Forum. I enjoyed teaching security concepts and giving fun training to in-house development and speaking at public events on the future of security and the current problems inherent with it. I love to write security industry opinion content.Created a log parsing program that finds attack patterns in log files, ranks them and provides natural language search. Developed an exploit workbench which assisted in building and hosting payloads for Web-app pen testing. The program used polymorphic smart payload fuzzing to generate syntactically correct candidate payloads that should be more likely to pass WAF, IDS and script filters. Created a security tool to perform recon, attack, and post exploitation with voice control.Handled compliance for HIPAA, PCI and NIST.CISSP, GWAPT, GPEN, GCIH

Salt Lake City, Utah, Us

SLC Corp is on the leading edge of mobile and geospatial applications to make government services accessible. Assisting that mission, I developed software and upgraded existing software using Microsoft C# MVC 4, and JQuery. Worked with a large team of experienced developers on a variety of systems and applications. Consulted on standard and obscure security issues including Kerberos authentication debugging.

Shrewsbury, Massachusetts, Us

Performed security advisory functions and served on the security management committee. Assisted the CTO in securing corporate concerns and advised on business continuity and planning. Performed security reviews and risk assessments. Provided security recommendations and assisted in development of critical software technologies. Designed and developed a BI solution and a paperless office framework for uHealthSolutions. uHealthSolutions, an offshoot of the University of Massachusetts medical school, assists the government and other organizations with healthcare processes and reform while also carrying out significant humanitarian efforts to enhance healthcare for the disadvantaged.Created a healthcare BI system in conjunction with the database team. The resulting data warehouse provided the basis for geographical trend and problem analysis. I contributed a neural network technology which allowed exceptionally accurate future cost analysis.Developed key software frameworks for document management including a full life-cycle document intake and recognition system for scanned paper and fax documents. Document management pieces I developed included: e-fax, high volume scanning, document cleanup/ocr, bar-coding, and recognition with OCR/ICR and document review and correction functionality.

Falls Church, Va, Us

Developed the ACES program which automates Top Secret clearance checking via direct rapsheet interfaces to JAG, Interpol, NCIS, NLETS and many other online law enforcement systems. Programmed components for secure data exhange and developed SSH tunneling scripts to manage secure file exchange between remote systems. Worked under CMMI 3-4 methodologies with a remote team. Developed in J2EE, Spring, BASH, Oracle 10g, using Eclipse, SVN, Toad etc.

Developed an AI system to predict medical costs for critically ill patients that was much more accurate than the leading commercial product. The system was able to accurately project future costs for the patient and also accurately predict how costs would rise if a specific disease were to present itself in patient's care cycle.Developed a new form of distance algorithm to match names, addresses, and numerical data with transpositions and misspellings. The program found duplicates in ETL loaded data that saved the company $5,000 per month in per-patient handling charges. Developed in Delphi, C#, ASP.NET

Rocky Hill, Ct, Us

Directed security efforts, audit and remediation including compliance. Developed healthcare claims transaction processing software. Provided strong encryption on claims transmission to healthcare payers. Developed a smart-web client with self healing capability and protocols for fault-tolerant communication. System development in Delphi, Visual Basic, C#, ASP, SQL Server etc.

Falls Church, Va, Us

Co-managed development, schedule and processes for the largest J2EE software project in the world. The EESOH system is designed to support 70,000 concurrent users world wide. It was built within the timeframe provided by the DOD and delivered on time with high user satisfaction. The EESOH system is still in use today. Lead team processes, standards, documentation and efforts to achieve ISO 9000 and CMMI level 3.Developed user management role based system that integrated with existing AF ldap systems. Wrote security policies and procedures, security risk assessment, security test plans and documentation for C2 certification for deployment of EESOH to the Global Combat Support Systems hosting center.

Provided computer security consulting to Salt Lake area businesses. Consulted with companies on protection of digital assets. Developed a USB token based VPN system for S3 that would produce encrypted USB tokens with keyed VPN software to ensure authenticated key-holders complete secure remote access to vital systems. Developed firewall management system that would report on employee web site usage and access to restricted sites. Developed a digital certificate production system that used PKI hardware to produce certificates for TrustWave.

Us

Designed and implemented HIPAA compatible systems including EDI, PKI and biometric security. Worked with CTO in buy/license/partner relationships. Developed custom security applications by evaluating vendors and integrating best-of-breed components into complete solutions. Designed and implemented a custom two-factor biometric and certificate based web security package for Blue Cross Blue Shield.Worked with CEO to put in place an industry standard certificate authority. Designed a usage model to provide secure authentication, single-sign on and identity validation for physicians representing multiple organizations.Investigated network incidents and kept policies current with changing threats and computer use patterns.Helped implement InfraGard in inner-mountain west area. Worked with Infra Gard members to implement a state wide incident sharing system.

Designed a web based security system based on customer requirements and current industry standards to satisfy strict government regulations regarding information security in healthcare. Developed protocols for exchanging data securely using custom mime types and client-side plug-in applications. Developed web friendly encryption and hash components using Delphi. Developed fingerprint login applications in VB that worked with plug-ins and a custom mime type handler to authenticate users over the web.Created a certificate authority system using the Microsoft Crypto API. Enabled the Certificate Authority to produce client and server SSL certificates, code signing, SMIME certificates etc. Wrote certificate practice statement and certificate plans for the company CA.(Purchased by Ingenix)

Began as a temp worker and soon was hired as a programmer, then manager, then Director and VP. Secured over 20 million in investment money based on software and provisional patents I created on behalf of HealthCast. Served on the Board of Directors and Management Committee for 4 years. Personally hired and worked with development staff to create software for use in the healthcare industry and other vertical markets. Designed solutions for a wide variety of applications ranging from security to document scanning and archiving, transcription, coding, chart tracking and voice operated applications. Developed world-class mainframe emulation software. Worked extensively with fingerprint verification and indexing fingerprint data.Directed development of large scale development efforts in behalf of not only Health+Cast but also for software products developed under contract with Shared Medical Systems (SMS) and QuadraMed. Ensured development efforts complied with upcoming HIPAA regulations by using strong encryption and employing strict security measures.Designed a trust-chain model for symmetric encryption using image-based shared secrets, hashed, signed and time-synchronized shared secrets provided unique keys per transaction and a safe way to share encrypted data. .