Mark Walla Email & Phone Number

San Jose, California, Us

Build and enhance the Secure Development Life-Cycle (SDLC), define application security technologies, and develop practices to secure Cadence applications. Responsible for application security architecture, risk assessment, and vulnerability management for diverse technologies and platforms. Perform assessments on Cadence applications in cloud, on-premise chambers, and co-location data centers for continuous security assessment processes, architecture review and penetration testing.Security Development Operations tools and technologies:• Open Source Security (OSS) - Software Composition Analysis (SCA) • Static Application Security Testing (SAST) • Dynamic Application Security Testing (DAST) • Runtime Application Self Protection (RASP) - Real Time Monitoring detection and prevention• Security Architecture Review - Threat Modeling• AWS and Azure WAF Configuration and whitelisting• DDOS configuration and operation• Manual Penetration Testing • Penetration testing with 3rd party vendors• Host level vulnerability Scanning • Web application security training course development and deliverySource Code Protection:• Github Enterprise deployment and consolidation world wide.• Artifactory and build component segmentation• SCA, SAST, DAST, and RASP Implementation Integration

San Jose, California, Us

San Jose, California, Us

San Mateo, California, Us

LEAD APPLICATION SECURITY ENGINEER (June 2015 - July 2015)Lead secure development lifecycle for cloud based gaming and social networks developed with agile methodology. Build and maintain application security program to protect RESTful APIs accessed from multiple JS clients in a cloud environment.Major SDL activities include: • Source Code Analysis• Penetration Testing• Threat Modeling• Architecture ReviewSR. APPLICATION SECURITY ENGINEER (January 2014 - June 2015)Product security for consoles, mobile, TV, and browser client services on Sony's PlayStation Network. Secure proprietary platforms for on demand streaming and download of games, videos, and music content. Work with development teams to produce security requirements, perform architecture review, deploy and support security tools and educate developers on secure coding practices. Build in security for cutting edge web technologies on private and commercial cloud based solutions.

Burbank, Ca, Us

Responsible for black box testing, source code analysis, manual pen testing, threat modeling and training. Interact with all Disney Business Units to discover, triage and resolve security vulnerabilities with manual and automated tools to enforce security criterion as part of a Secure Development Life Cycle on a continuous basis. Oversee threat modeling and security risk assessments activities to ensure that security risk is measured and kept at an accepted level. Perform security incident management, open source security assessment, security training and awareness.

Tokyo, Japan, Jp

Web Application Security - Check points and processes for Web application security - Deliver Web Attack classes to development teams - Web application scanning tools and source code analysis tools - Policy, standard, and inventories for websites and servicesSecurity Architecture - Security architecture review - Project design and deployment - Infrastructure and security

San Jose, California, Us

Information Security Architect - Architecture and Technology - leading the Information Security architecture strategy, driving the development of technical security related standards and guidelinesAssurance & Compliance - evaluating and monitoring compliance to security and privacy policies and providing guidance on how to best achieve compliance Awareness & Education - elevating awareness of security and privacy policies and best practices throughout the companySecurity Best Practices - documenting the policies, procedures, and guidelines comprising security and privacy best practices

• Directed commercial development/deployment of IT security event auditing and reporting software • Developed partner relationship as a Microsoft Gold Certified Partner, Hewlett Packard Developer and Enterprise Partner, and IBM Advanced Business Partner• Managed and conducted customer security assessments, regulatory compliance audits, specialized software implementation for SOX, FISMA, HIPAA, PCI, JFAN, DITSCAP, DIACAP, DCID 6/3and GLBA • For Santa Clara County, managed development of solutions around Microsoft Operations Manager (MOM) 2005 and System Center Operations Manager (SCOM) 2007 to monitor performance, alert and event data in a heterogeneous enterprise. Architected and built a framework to gather, correlate and report on data from Solaris, Cisco, Apache, Windows, syslogs, and custom applications.• Conceived, designed, developed and supported ECC eSCOP™ administrative console for System Center Operations Manager 2007’s Audit Collection Services (ACS). ECC eSCOP™ is designed to report, filter and archive extremely large, enterprise-wide security event log data repositories. Building on the ACS capability to collect and store terabytes of IT events, ECC eSCOP™ provides IT professionals with the tools to facilitate protected and discrete filtering, custom report generation, and logical archiving at improved speeds. • Designed and developed three auditing packages that leverage MOM 2005 to track Windows Server and Microsoft ISA Server events for regulatory governance in regards to FISMA, GLBA, Sarbanes-Oxley, and HIPAA.• Designed and developed event reporting using SQL Server 2005 Reporting Services for event collection and correlation with regulatory requirements. These reports are used to analyze and organize data for selective auditing using event detail information, summary tables, trend analysis, and group graphs. See white papers and product info: http://www.enterprisecertified.com/products.htm

• Served as a member of executive committee for publicly traded company.• Managed entire R&D operation including P&L, staff, requirements, reporting to the CEO.• Managed, designed and directed development of several compliance tools that pull together Microsoft server products to produce compliance solutions. These include the Manakoa Compliance Services (MCS) asset manager and the Manakoa Systems Control Management Pack (SCMP). The MCS workflow product assigns ownership to corporate assets discovered in Active Directory to track and report on regulatory assessment of IT assets. Assessment information is collected in SQL Server 2000 and then reported using Microsoft SQL Server 2000 Reporting Services. The product comes with templates for Sarbanes Oxley, GLBA, HIPAA, FISMA, and customizable to other regulations. The product also allows customers to input their own regulations for assessment tracking. The SCMP product configures Microsoft Operations Manager to collect security events in 5 main areas, including logon/off, Active Directory changes, group Policy changes, etc for security event audit tracking as required by Sarbanes Oxley section 404. Great response from the field with this product, and is scheduled to by installed in the Microsoft Technology Centers around the world. • Spoke at the Microsoft Management Summit (MMS) in Las Vegas presenting compliance tools I had designed to integrate with Microsoft products, including Active Directory and Microsoft Operations Manager (MOM).• Completed next book in best selling “Ultimate Windows” series by Addison Wesley on Windows Server 2003.• Wrote white papers for Microsoft on high performance computing and co-authored “Responding to Regulatory Compliance: Microsoft and Manakoa Technology Foundations” Microsoft TechNet (August 2005) • Designed and implemented several custom applications for clients based on both .NET C#/ASPX and Java/JSP development server platforms.