Gregory B. Email & Phone Number

Chicago, Il, Us

To Manage Risk through Partnerships with Diverse, Global Teams that Promote and Educate on Application Security Best Practices and Standards.

Redlands, Ca, Us

A member of the Esri Software Security & Privacy Team reporting to the Product CISO to define and implement security strategies that reduces risk in Esri's global products based on the Build In Security Maturity Model (BSIMM). This includes promoting/mentoring of application security, performing vulnerability scans, creating threat models and defining remediation strategies across Esri's development teams - globally (US, China, Australia, Canada, etc).• Advancing product certifications by maintaining ArcGIS Online FedRAMP Moderate compliance. Participating in audits and leads the security impact analysis to ensure new and updated features do not negativity impact the authorization to operate through threat modeling and risk assessment. Provides architecture gap analysis for enhancements.• Working with Product Security Incident Response Team to promote discussions with development teams to remediate or mitigate Customer reported issues. Uses CVSS and CWE metrics based on reported items to recommend product architectural and design improvements.• Advancing security by defining gate controls into each phase of the software development lifecycle (SSDL) based on BSIMM. Assists with analysis of SAST, 3rd party component scans, DAST and helping Teams with remediation efforts. Creating and maintaining checklists and guidance documents that covers languages, packaging (web, mobile, container) and technologies.• Providing security guidance to external customers at Esri Conferences to help increase security assurance through presentations and in-person Q&A. Creates and maintains the ArcGIS Security Advisor web application that provides policy feedback about the ArcGIS Online settings.• Incorporating security components into Esri products by working with development teams to recognize areas where standardized reusable libraries could be used. For example, standardize cryptography what identified that resulted in the creation of the Crypto Toolkit Java library.

Costa Mesa, Ca, Us

A Software Architect and Team Lead for Experian’s DA Fraud Solutions Group. Worked with internal and external Clients, Management, Project Managers, QA, DBAs and System Engineers to develop Fraud related solutions. Led Teams within the US, Chile and Costa Rica to deliver quality solutions that results in multi-million dollar revenues. In addition, worked on Application Security efforts.• Led the Precise ID Personal Protection Alerts (PIPPA) project which received “Launch Of The Year” award. This direct to consumer service solution notified consumers when their identity had been verified by Experian fraud products. • Led the Fraud Archive Reporting Service (FARS), a Restful web service used by Centers for Medicare and Medicaid Services (CMS) for the Affordable Health Care system to help with identity verification. • Led the business verification solution (BizID) that verified business information for accuracy and truthfulness. This solution provided fraud risk scoring and decisioning to help mitigate commercial fraud.• Led multiple solutions for DA’s Precise ID - a risk based fraud detection and prevention platform. These solutions ranged from increasing product availability, to providing client custom solutions. • Designed and implemented changes for security threats based on Open Web Application Security Project (OWASP) levels. This allowed code to pass static, dynamic and manual penetration testing in order to receive internal security certification from the Business Information Security Officer (BISO).• Authored the Experian Fraud Solutions Group’s security system document following the NIST 800-18 and NIST 800-53 publications which allowed Experian to compete and gain US Government contracts.• Worked on security assessment initiative with Experian Business, Experian Corporate Security and Amazon to use the Amazon Web Services (AWS) architecture. Authored a security plan based on the Cloud Security Alliance (CSA).

A member of the connectivity Team responsible for the client side connection stack used to access the Tigerlogic XML Data Management Server (XDMS). The connection stack included a Java API (XQL), JCA API and soap web service. In addition, provided reusable components for other Teams.• Designed, implemented, tested, maintained and documented various code modules within the product: the XQL (no SQL) datasource API, soap web service API, IO Stream Paging library, and JNDI Tree.• Created an Object Pool library that revealed and solved a hidden application thread issue by implementing an object ownership check.• Re-factored/redesigned the existing J2EE Connectivity Architecture (JCA) CCI and SPI code. High- load scalability was increased by implementing threading and connection pools that used the Object Pool library.

Java Consultant through TEKSystems.• Designed, developed, documented, and load-tested performance of new business functionality for the Avery.com website.• Worked with the team from Germany to develop functionality for the Avery- Zweckform.com web site.• Developed the AltaVista site-wide and product search UI component.

• Led the architecture, design and development of the company’s J2EE based Operational Support System (OSS) in order to create a billing system that tied into the existing legacy system.• Completed build versus buy analysis to determine appropriate products and processes.• Delivered functioning prototype of the billing system.

• Led several projects, including the Miller Lite Virtual Racing League and EnergyPortal.com that generated multi-million dollar revenues.• Promoted to Lead Developer.• Developed a website prototype using ColdFusion for a customer that led to $500,000 in revenue.• Organized and led a once-a-week technology discussion group.• Developed a reusable object pool that was used to implement a socket connection pool

Reston, Va, Us

• Developed a distributed Hypertext analysis architecture using RMI and the Model-View-Controller (MVC) pattern.• Gathered, compiled and sent news articles about the development of Java and other technologies to email group.• Participated in Design Patterns group discussions.• Performed object database analysis that allowed Management to make a buy decision.• Underwent a single scope background investigation to handle DoD sensitive information.

• Maintained in-house C/C++ object transfer framework.• Implemented the C/C++ object transfer framework in Java and tested on HP unix, Windows, Solaris and Sun OS.• Was able to breakdown a visual issue in a commercial C/C++ GUI windowing framework into multiple smaller bugs that speeded up correction.• Developed Java Applets using AWT and a Java proxy server to handle applet calls.• Underwent background investigation to handle DoD sensitive information.

Bachelor'S Degree, Computer Science

Associate'S Degree, Mathematics