Doug Morato Email & Phone Number

Las Vegas, Nv, Us

Kapolei, Hi, Us

Newport Beach, Ca, Us

Livonia, Mi, Us

Plantation, Fl, Us

Gb

• Consulting with applications and business teams to provide initial / high level and detailed application architecture security recommendations.• Provide guidance to customers towards meeting all the information security requirements.• Drive implementation of security in SDLC, providing integrations for build automation, Sec DevOps• Gather requirements, evaluate, compare and provide SME advice on new Application Security related services or products• Collaborate, Review and ratify any proposed / updated technology standard.• Design, plan, implement and operate roll-out of HP Fortify On Demand (HP FOD) as replacement for on-premises HP Fortify.• Design, plan, implement and operate JIRA Service Desk ticking system for communication transparency and managing the high workload of the team. • Drive creation of internal Linux configuration standards aligned with NIST and CIS CAT standards.• Design, plan, implement and operate globally accessible instance of Atlassian JIRA, Confluence and Bamboo• Develop and maintain AppSec / Sec DevOps related integration scripts for Atlassian Bamboo, Jenkins, Microsoft TFS and VSTS, TeamCity.• Lead re-development of the global Application Security Assessment Portal, leveraged for standardizing vulnerabilities definitions and recommendations, methodology and reporting.• Design, plan, implement and maintain JFrog Artifactoy artifact repository.• Maintain, upgrade and operate Static Code Analysis (HP Fortify) and Penetration Testing infrastructure.• Lead and create Application Security internal and customer facing process and methodology documentation.• Collaborate in every DevOps work stream to streamline application security related tasks.• Assist applications to leverage in-house identify provider for AuthN/AuthZ, using SAML, OAUTH / OpenID, WS-Fed, LDAP• Administrative responsibilities regarding the CloudLock CASB solution.

Houston, Texas, Us

Provide training on Secure Development Lifecycle. Deliver workshops about fundamentals of application security, secure application development and implementation of Software Security Assurance (SSA) methodologies.Work with customers to identify their needs on the implementation of Secure Development Policies, Metrics, Processes, Guidelines, Standards & Procedures.Implement HP Enterprise Security Products & Solutions including: • HP Fortify Static Code Analyzer (SCA); • HP Fortify Software Security Center (SSC); • HP Fortify Application View and Application Protection;• HP WebInspect & WebInspect Enterprise;• HP TippingPoint IPS;• HP TippingPoint NGFW; Educate and instruct HP customers on the use and implementation of the solutions offered by HP Enterprise Security Products.Perform Static Analysis utilizing HP Fortify SCA and Dynamic Analysis using HP WebInspect.

Purchase, Ny, Us

• Perform multiple penetration tests of internal and external facing network assets, web applications, thick clients, mobile applications.• Work with Internal Security Assessors on definition of scope for vulnerability analysis, developing a penetration testing plan and conduction penetration tests to support IRoC and RoC.• Work with management and members of the team in mobile risk assessment and mobile platform testing.• Assist development teams to understand security issues and vulnerabilities reported and provided advicefor remediation plan.

Burbank, Ca, Us

• Perform multiple Static Code Analysis (SCA), using HP Fortify and HP Audit Workbench as a tool to assess security issues and vulnerabilities on source code of Java, .NET, Android and iOS applications• Implement automation of source code quality metrics tools such as FindBugs, PMD, CheckStyle, Sonar(javanalysissuite) in the build process, along with automation of the Static Code Analysis using HP Foritfy.• Assist Lead Developers, Tech Leads and modules teams to understand security issues andvulnerabilities and provided advice for remediation plan.• Work with Management and Leadership providing SME advice, risk assessment and analysis of impact.• Worked with Security & Compliance Architect to implement his vision for Secure SDLC for the programand also worked with Release Leads in order to assess and verify security posture of modules going intoproduction.• Exploratory and discovery research to track down all deployable artifacts, which lead to increasing thenumber of scanned projects by 2x and number of lines of code by 1.5x• Perform manual security penetration testing in applications that contained Web User Interfaces.• Perform security assessments and penetration tests of guest and cast facing mobile applications.• Assessments on overall security of Mobile Platform and security policies implemented by the company.

• Performed multiple vulnerability assessments and recommendations for remediation, web application penetration tests, network penetration tests, security audits and also implemented solutions, which helped our customer to achieve compliance and an acceptable level of security.• Performed secure code reviews, analysis , reporting and actively participated on SDLC and ALM process, acting as team lead and Subject Mater Expert for the development team, utilizing tools such as HP Foritfy SCA, HP WebInspect, HP Quality Center, HP Service Manager.• Responsible to develop and establish the security practice and compliance of an e-commerce company building their framework in-house, leveraging the cloud environment for their quick expansion, while protecting their IT assets.• Worked closely with dynamic teams, composed of network admins, firewall admins, developers, network architects, information security team, incident handlers and also the management level in several instances, providing clear and concise information, reports and directions regarding the security audits.• Evaluated, recommended and implemented complex systems, such as SIEMs, 2-Factor authentication, NACs, logging and correlation solutions such as Archsight, AlienVault, Firewalls and IDS solutions, automated code deployments (Continuous Integration), automatic scalability using cloud (On Amazon AWS and Rackspace), ERPs, CRMs, unified communications, active-directory, IT and development operations solutions for companies that needed expert advice regarding how to be more agile in their IT Operations.• Experience with performing and publishing web application and network security assessments.• Experience with mentoring, training and working with teams to better recognize security vulnerabilitiesand flaws.• Extensive experience performing manual network and application assessments and penetrationtests, stealth testing, and intrusion detection effectiveness testing.

Trainer and Consultant in the Information Security, Virtualization, Cloud Computing and Enterprise Management fields.Strategic logistics and operations management for our training sessions throughout the US and Canada.I also worked as Teaching Assistant through VMware's Partner Enablement initiatives.

During my time working for Voxxus, an IP telephony service provider, I performed VoIP hardware and software interoperability tests and recommendation. I installed, configured and maintained open-source IP-PBXs for customers and our corporate use, specially in the call center markets.I also acted as lead of customer support in order to turn around tense situations to a positive outcome bringing the problem solution;

I founded Corporatec to enable our customers to communicate better and help them safeguard their assets.We performed vulnerability assessments, penetration testing, planning, coordination and implementation and deployment of security measures and solutions, helping them to regulate access to computer data files and prevent unauthorized modification, destruction, or disclosure of information, malicious software detection, analysis and removal;We also deployed and integrated VoIP, IP telephony and UCS solutions, open-source and proprietary, to our customers in to order to enable them to take full advantage of an uncomplicated and powerful communication systems.

Bachelor Of Science - Bs, Cybersecurity And Information Assurance

Computer Network Technology Technician

Electrical Engineering