Eric Hess Email & Phone Number

San Ramon, Ca, Us

Assess, design, plan, and execute overall enterprise security program. Program was non-existent prior to my arrival and needed a framework and structure to focus, track, and repeat all existing disparate efforts across the enterprise. Leveraging a risk framework combining NIST CSF, CIS 18, and Secure Controls Framework, the program has a solid direction with metrics that track progress and identify areas of priorities. Overall responsibilities: - Develop and execute enterprise security program strategic vision and roadmap based on a balance of risk reduction and practical security measures - Prioritize and implement security initiatives to protect the business while allowing for speed and flexibility to achieve company objectives - Govern the Enterprise threat & vulnerability management program including identifying, assessing, and driving remediation of vulnerabilities - Lead the Cyber Security Operations team responsible for monitoring and responding to cyber and information security incidents - Develop and enhance the skills and experience of both infrastructure and operational staff with specific security responsibilities to ensure that systems remain secure, available, and functional always - Measure staff’s performance through annual performance appraisals and provide training/development for continuous improvement

Santa Clara, California, Us

Responsible for maturation and growth of information security and risk programs company-wide, covering compliance initiatives, policies and standards, and day to day operations including: vuln management, monitoring, training, authentication improvements, incident management, product security, cloud security, vendor assessments/management, and customer contract reviews.▪ Provide security leadership to the IT organization and be a trusted partner to legal and HR.▪ Develop an information security and risk management framework leveraging CIS20, NIST CSF,OWASPSAMM, among others.▪ Complete incident response ownership, from detection to postmortem.▪ Provide current knowledge and future vision of security technology and systems to IT and the business.▪ Develop and monitor a strategic, comprehensive enterprise information security, IT risk management program.▪ Work directly with business units to facilitate risk assessment and risk management processes (SOC2, incidentresponse and remediations, policies and standards, etc.).▪ Establish committees to ensure the consistent application of policies and standards across all technology projects,systems and services.▪ Partner with business stakeholders across the company to raise awareness of risk management concerns.▪ Support IT security inquiries from customers and vendor security assessments.▪ Develop and deliver virtual and in-person end-user cyber security awareness training.▪ Respond to and resolve incidents and vulnerabilities and assess for risk, prevention, and remediation.▪ Develop ongoing operations metrics for daily management of security discipline and for leadership visibility.▪ Support and assist with external audits/assessments, certifications and accreditation's to achieve and maintaincompliance (SOC2 and ISO).▪ Communicate with stakeholders - individual contributors up to executive management.▪ Support and drive issues relating to audit compliance frameworks such as SOC2, ISO, GDPR, etc

Santa Cruz, Ca, Us

Responsible for growing a comprehensive information security program spanning entire global organization. Vulnerability management, policy writing, product security, endpoint protection, incident response/threat hunting, vendor engagements, tool assessments/implementations, compliance, pentesting, secure software development program, phishing investigation/validation, and custom security awareness training have all been within the scope of this role. ▪ Leverage vulnerability scanning and custom tools to assess and investigate network based vulnerabilities across the enterprise, engineering, and production environments.▪ Drive remediations of vulnerabilities and pentest findings via business partnerships, policies, reporting, and exploit examples. ▪ Identify gaps in log/sensor visibility for east/west network traffic and make recommendations to update network and sysadmin configurations and architectures to remediate.▪ Manage and guide three direct report interns ▪ Document and create runbooks for account compromises (including alignment with service desk, log investigation to determine files/networks accessed, etc.), phishing response (including identifying risk/quality of campaign, attribution, eradication, and prevention) and Risk/Targeted Vulnerability Remediations (considering length of exposure, zero day reporting, and risk to organization).▪ Recent incident responses have included worms, ransomware, and cryptominers. Partner with various organizations to perform block and tackle containment and eradication, make recommendations for recovery, and assist with preparations, architectural changes, and process improvements during postmortems.▪ Run point for customer security questionnaires and assist with GDPR efforts.▪ Authored vulnerability management, incident response, patch, and supported OS policies.

Mountain View, Ca, Us

Cloud-based DNA sequencing platform hosted in AWS and Azure. My main functions were to improve the efficiency and efficacy of the vulnerability management program, assist with ongoing ISO certification and audit, and most importantly ensure that the platform became FedRAMP moderate authorized.▪ Previous attempt to receive authorization resulted in failure, and I took to the 100’s of points of failure and designed and drove a program to achieve FedRAMP moderate authorization, despite disinterest among critical stakeholders.▪ Researched and studied API documentations to create a scripted solution that automated the Qualys vulnerability scanning and management process to include host discovery, inventory maintenance, and scan scheduling in a highly elastic and scaled environment AWS EC2 environment.

Houston, Texas, Us

Working in the CTO office on the Cyber Security PMO, I provided technical program management for multi-disciplinary security projects across the Enterprise Group R&D (~27k people, ~$30bn annual sales). Projects included Environment Hardening (based on Risk Management Framework RMF and NIST 800-53) and Vulnerability Management across hundreds of subnets and hundreds of thousands of IPs.

Houston, Texas, Us

Software Defined Networking (SDN), Aruba Clearpass, and Docker Special Projects. Research, examine, and test security and networking features of SDN and Aruba Clearpass for use in shared R&D lab environments, pan-HPE. Partnered with Docker, work to understand security concerns that impact Docker containers and how to manage those risks to better enable Docker to find acceptance in the Enterprise.Successfully Completed Assignment to HP/HPE Company Split “SWAT” Team:Worked to design, plan, schedule, execute, and troubleshoot migration off of hp.com to new Hewlett Packard Enterprise sub-domains while minimizing or eliminating impact to internal business and external customers. Aligned internal resources, escalated, and created process for undiscovered roadblocks to the process of migration of 1000+ subnets across 150+ sites with 280+ owners, in an extremely accelerated and aggressive timeline.

Houston, Texas, Us

Provide networking security expertise and overall engineering leadership and perspective to cross-organization projects, programs, and activities. Work actively with multiple R&D labs to assure the networking security design meets the businesses requirements. Manage the networking security review process working directly with HP-IT Security. Work with HP-IT Global Telecom to assure adequate networking performance for the businesses. Assure tracking and documentation of networking security requirements and exceptions. Provide guidance and mentoring to less-experienced staff members. - Lead role in incident, escalation, problem, and change management efforts that impact 25+ unique network compartments in three data centers spanning 50,000 sq/ft. Labs account for over $1 billion in annual revenue.

Ba

Mas, It Management