Grant Bugher Email & Phone Number

Kirkland, Wa, Us

Seattle, Washington, Us

Head of security for Outreach products, services, and underlying infrastructure. Define and own security roadmap, budget, and KPIs. Create quarterly, annual and long-term security and risk management goals, strategies, and metrics to align with ISMS and Risk Treatment Plans. Support organization's ISO 27001, SOC 2 Type II, and other certifications and audits. Produce and own product security policies, baselines, and SOPs, and evaluate and prioritize security projects based on enterprise risk, cost, and capacity for change.• Hired and led a mostly-remote workforce of security engineers and TPMs while developing a comprehensive product and application security function from the ground up. Led implementation of SAST, SCA, security development lifecycle, penetration testing, and vulnerability/incident remediation programs in Outreach's global, multi-cloud environment across AWS, GCP, and Azure platforms.• Represented Outreach on frequent direct customer interactions, as well as authoring whitepapers and marketing material representing Outreach's security posture and features. Contributed to acquisition of several million dollars in annual recurring revenue.

San Francisco, California, Us

Head of product security for Twitch products and services. Built a comprehensive product and application security function for both internal and 3rd-party development, including hiring the team and creating policies and standards. Defined and owned security roadmap, budget, and KPIs for Twitch product security. Led risk management and analysis for suppliers, partners, and vendors.• Replaced a review-checkpoint model of application security with a comprehensive security lifecycle, including threat modeling, code analysis, and automation, with education and tools to allow engineering teams to assess and improve their own security. Implemented SAST, SCA, and threat modeling processes.• Used metrics, KPIs, and reporting to drive a massive reduction in technical debt, reducing known Severity 1 and 2 vulnerabilities from over 200 to zero.

Redmond, Wa, Us

Head of product & application security for the Skype for Business and Microsoft Teams products.• Developed a security engagement model designed for Skype's agile development methodologies, implementing threat models, design assessments, and security code reviews for Skype for Business and Microsoft Teams features and releases. Delivered gap analysis and security risk assessments during migration of Skype products to Microsoft Azure infrastructure & services.• Coordinated security incident response and remediation for incidents in all of Skype's Enterprise products and services.

Redmond, Washington, Us

Formed, hired, and led security architecture and advisory program for all Microsoft online services businesses including Microsoft 365, Microsoft Azure, Bing, and Microsoft Account.• Hired and mentored a high-performing team of security engineers and architects. Developed a resilient team structure with advancement opportunities and career paths for team members.• Pioneered Operational Security Assurance, a multi-year program for assuring operational security in a web-scale, heterogeneous environment with clear standards and an assessment, verification, and remediation process. Used my experience in developing the Security Development Lifecycle program for online services to bring similar rigor to operations security.• Managed multiple cross-disciplinary programs and projects across multiple years and releases while maintaining high performance in each, including an assurance and verification process, long-term dedicated consulting engagements, a venture integration risk assessment program, a change adviser/review process for one of the world’s largest production networks, and a solutions program for turning consulting engagements into a portfolio of re-usable solutions.• Developed reference architecture for Microsoft’s Sovereign Cloud programs, designing an environment to meet rigorous compliance obligations (FIPS, FISMA and FedRAMP) for government customers while maintaining service agility and keeping costs low.• Drove governance process for Sovereign Cloud deployments, bringing together data on business impact across multiple products to a senior leadership team for governance and risk management and negotiating with executive stakeholders.

Redmond, Washington, Us

Owner of the Security Development Lifecycle (SDL) program for online services at Microsoft.• Created a risk-based application security program for cloud and online applications, both for within Microsoft and for Microsoft's external SDL publications, based on the Security Development Lifecycle used for developing Microsoft’s desktop/server products. Adapted this program for waterfall, Agile, SCRUM, and other development methodologies.• Directly managed a million-dollar budget and 12-person team, as well as setting security requirements and responsibilities for security engineers across over 200 product teams. • As a member of Microsoft's SDL Development core team, led efforts to make the Security Development Lifecycle appropriate to fast-paced online services, agile methodologies, and continuous deployment.• Advised ISC2 on exam questions for the CSSLP certification as an industry expert on security development lifecycles.

Seattle, Washington, Us

Redmond, Washington, Us

Redmond, Washington, Us

B.S., Computer Information Systems, Business Process Management, Entrepreneurship

B.A., Political Science