David Eason Email & Phone Number

Denver, Co, Us

Denver Metropolitan Area

I architected and implemented the company's DevSecOps standards and tooling related to secure application development. This reduced the company’s cybersecurity portfolio vulnerabilities 96% while demonstrating DoD security compliance. The resulting systems are automated, deployed, and transferrable to both cloud and air-gapped systems using infrastructure-as-code (IaC). These efforts accelerate development cycles and automate generation of compliance artifacts.KEY ACCOMPLISHMENTSEngineered all security aspects of a DevSecOps CI/CD pipeline.● Implemented security tooling with containers, deployed using infrastructure as code (IaC via Docker, Ansible, Terraform) into ESXi VMs and AWS.● Alerted developers and tool maintainers to compliance, STIG, and CVE problems.● Scans included compliance (ACAS), static (SAST), dynamic (DAST), policy as code (PAC), and software component analysis (SCA).● Established supply-chain transparency and dependency checks through automated software bill of materials (SBOM) generation, OSINT CVE ingestion, and analysis.● Reduced vulnerabilities through automated feedback from the pipelined PAC enforcement.● Scanned and hardened the pipeline tooling itself with the same processes as its products.● Automated creation of ISSO eMASS bodies of evidence (BoE) to support interim authority to test (IATT) and authorizations to operate (ATO).● Authored and incorporated cybersecurity strategy into the System Engineering Plan.Planned and executed proofs of concept for future company growth in the areas of:● Zero-trust architecture (ZTA), using mesh VPNs and IAC-deployable intrusion prevention systems (IPS).● Eliminating static credentials, requiring MFA, self-expiring credentials, and role-chaining for all AWS CLI actions, using STS, SSM, and ABAC.● Leveraging AI/ML systems for hardening CI/CD infrastructure.● Engineering continuous Golden Image updates with automated STIG SCAP scanning and Ansible-driven STIG control hardening.

Stamford, Connecticut, Us

Protected critical infrastructure, services, and customers from cyber threats by creating, improving, and using tools and processes to quickly detect and respond to external security incidents, minimize data loss, initiate forensics, and regularly assess the security of our network to prevent brand, reputation or financial damage. Key accomplishments:● Lead Tier 1 basic and advanced training on incident response, detailed ticket activities, automation, and process improvements for 14 Cyber Defense Center staff.● Evaluated governance risk and compliance (GRC) solutions to help achieve PCI-DSS compliance and prioritize efforts to reduce cyber risk across the enterprise.● Hunted for shadow IT during penetration testing efforts in a senior Risk and Threat Management (RTM) team during the early phase of the COVID pandemic.● Configured and tuned intrusion detection and prevention tools using Splunk to identify anomalous user and system behavior, generate reports, and throw actionable alerts.● Created and maintained automation tools to increase incident response speed by over 90%.● Incident management, defending against external threats for 50 million customers in 41 states, monitoring and improving SIEM and IDS systems, coordinating resources and escalations, and suggesting improvements to reduce vulnerabilities.● Promoted in March, 2020 to an RTM/GRC role, with management interested in my Systems Security Engineering ideas (see published article, linked below).

Stamford, Connecticut, Us

Created and executed processes to manage multiple release trains through test environments to prepare for safe, repeatable, well-documented production deployments. This supported Charter’s rollout of Spectrum releases to 21 markets in 41 states, serving over 50 million customers.Key Accomplishments:● Created key DevOps processes to manage, control, plan, and record current and planned future environment states for concurrent release trains and programs. This assisted program management, test leads, and lab staff with planning and coordinating releases into test and production environments.● Gathered metrics to assist program managers with release planning, such as estimating the time needed during test cycles to do point releases to fix launch-gating bugs.● Conducted detailed reviews of deployment plans, including staging, pre-checks, deployment, validation, and rollback planning.● Coordinated release packaging, testing, and deployment across multiple teams, meeting daily with project and program managers and leaders of development, test, and infrastructure.● Established and documented gating requirements for release trains and environment changes, with due consideration to service level agreements, regulatory requirements, and user needs.● Ran a daily change control board. Tracked project milestones and communicated impacts to stakeholders, managing program challenges and possible release train collisions and resource limitations.● Refined upstream processes based on deployment experiences, such as pre-testing certain deployment and validation steps in staging and automating steps using Chef and scripts.

Architected and automated release and code management processes and managed the source code security for over 50 release trains, 600 git and subversion repositories, and 1000 developers and testers worldwide in a follow-the-sun approach to global product development. This effort continuously built, tested, and deployed our products using 200 virtual machines with 7 operating systems in a distributed, private cloud infrastructure. System engineered new processes and tooling to reduce product delivery time by 90%, diminish account management administration time by 95%, and achieve a recovery time objective of 5 minutes with 99.9+% uptime for critical source code management systems.Key Accomplishments:● Identity, access, and credential management: created and managed the source code access provisioning lifecycle and account monitoring and auditing standards and systems for 1000 developers and QA staff. Architected infrastructure and programs to automate those processes, which distributed the authorization duties among the technical leads and automated much of the routine data custodian tasks, reducing staff load by 95%.● Security and risk management: documented, implemented, and audited company security policies related to source code access, such as restricting proprietary code by company or countries and limiting exports of strong encryption libraries. Reduced the recovery time objective (RTO) for source code commit interruptions to five minutes. Administered Linux systems to harden infrastructure and increase availability across a geographically dispersed private cloud.● Security architecture and engineering: setup remote logging and log monitoring (SIEM) for intrusion detection (IDS). Tuned credential caching and improved LDAP integration.● Communication and network security: configured firewalls and load balancers to increase infrastructure reliability and security. Created an IDS to monitor firewall, load balancer, and application logs.

Ms, Computer Science

Graduate Certificate, Cybersecurity

Bs, Psychology