Jamie Finnigan Email & Phone Number

Seattle, Wa, Us

Greater Seattle Area

Established and led a team of product security managers and engineers doing product-specific and portfolio-wide work across the range of HashiCorp products including Vault, Terraform, Consul, Nomad, Vagrant, Packer, Boundary, and Waypoint offered as a combination of self-hosted and cloud / managed services.Ownership of or contribution to areas and processes including security architecture / design, threat modeling, security testing / automation, code security review, vulnerability management, externally-sourced security assessments, customer education / trust, and more.I discussed various aspects of our approach on the Modern Security Podcast, https://www.youtube.com/watch?v=U9GWqWahPbA.

Greater Seattle Area

Built out the security program at Arivale, a scientific wellness startup.Worked closely with Product Development teams using agile / devops methodologies to build secure web & mobile apps and supporting services. Worked with the IT team to deploy & operate secure business applications and supporting infrastructure.Performed hands-on management of cloud-centric technology environment, using infrastructure-as-code and containers to build, test, deploy & monitor customer-facing applications and backend.Created custom security tools to gather / aggregate information, track change / variance, identify outliers, and address weaknesses.Managed externally-sourced penetration tests, investigated vulnerability reports, and remediated security issues.Defined & extended security architecture, drove security engineering requirements, wrote security policy & procedures, executed vendor security reviews, and contributed significantly to HIPAA compliance efforts.Temporarily managed subset of engineering organization during leadership transition period. Also participated in orderly system / infrastructure shutdown after business operations were shutdown.

Greater Seattle Area

Technical management role within the security team at HPE Cloud, with responsibility for security across the Helion portfolio of OpenStack-based cloud products and services.Directed and participated in activities across security disciplines with an emphasis on the product / service security lifecycle.Worked with product management and engineering teams across the business unit to ensure that security was adequately addressed through requirements definition, architecture design & review, threat analysis, security testing, and compliance assessment / remediation.Presented to and engaged with customers as security SME in support of HPE Helion sales teams.Lead and contributed to efforts to integrate security-specific automation and tooling into the Helion CI/CD pipeline.Wrote initial version of Bandit, a Python code security analysis tool, which we released as an open source OpenStack project. Continued to contribute as core team member.

Responsibilities included web and mobile application security testing, source code review (PHP, HTML / Javascript, ActionScript, Java, Python, Objective-C, others), architecture review, and tool development (Python, Javascript).Communicated security issues to management and developers, provided remediation guidance, and validated fixes.Built and open-sourced Hiccup, a Python framework that allows the Burp Suite web application security testing tool to be extended and customized.

Lead and executed technical (penetration testing / vulnerability assessment) and non-technical (capability / maturity) risk assessments across corporate & mobile networks and product elements, teaming with business & IT counterparts.Worked consultatively across functions to investigate emerging security risks, define mitigation strategy and guidance, and develop / deliver risk-focused executive reporting.

Held a client-facing consulting management role for an industry-leading computer security services firm, with responsibility for aspects of business development, engagement scoping / delivery, and client relationships. Managed and participated in various security assessment and compliance engagements, including physical security penetration testing, network/web/wireless penetration testing, and PCI DSS security assessments.

Assisted a range of local and global Deloitte clients in identifying and mitigating critical security issues within their business / technology environments, through provision of IT risk assessment and security testing services.Performed web application and network security assessments and identified a range of vulnerabilities for a variety of clients, with targets ranging from complete enterprise environments to specific technology elements such as e-commerce platforms, digital rights management solutions, and Internet banking applications.Delivered according to manager-level responsibilities for engagement scoping, planning, budgeting, day-to-day oversight of on-site and remote team, hands-on testing, and report preparation / presentation. Participated in sales process.

Early employee at startup ISP which was acquired by a larger telecommunications provider. Performed operational and security-related system administration duties for UNIX-based (Linux, BSD, and Solaris) platforms. Managed web, mail, DNS, and database services with minimal downtime and high customer service / satisfaction levels.