Mark Merkow, Cissp, Cism, Csslp Email & Phone Number

Tempe, Az, Us

Phoenix, Az, Us

Working on the Application Security Team at Freeport to help develop a culturally-appropriate and effective end-to-end software security practice.

Denver, Colorado, Us

Palo Alto, Ca, Us

Community Member

Denver, Colorado, Us

Course developer and instructor in University College for the Information and Computer Technology courses. Specialize in Computer Security Fundamentals, Security Education, Training, and Awareness (SETA) Programs, Application Software Security, and Access Control Systems.

Lisle, Illinois, Us

Adjunct faculty in College of Engineering and Information Systems (E&IS) for DeVry and Keller online programs.

Draper, Ut, Us

• Served on Security Architecture Team working to migrate legacy Web applications to MS Azure through reusable architecture patterns and reference architectures, code reuse, and application decomposition into microservices with REST API communications.• Worked on evaluating vendor security programs and questionnaires via Graphite Connect in support of People and Partner Security• Developed and delivered annual role-based Application Security Refresher training for all scrum teams• Assisted in corporate-wide security awareness campaigns and National Cybersecurity Awareness Month (NCSAM)

Westlake, Texas, Us

-Developed and implemented a holistic secure software development lifecycle for all enterprise-level applications in both RUP and Scrum/Agile development methodologies-Trained over 700 development team members across 8 development roles in secure application requirements analysis, design, development, testing, and rollout-Maturing the program as new Agile teams come onboard and as new vulnerabilities pop up-Developed and began implementation of a Talent Strategy to map employee roles to the NICE Framework Work Roles to determine coverage and depth of Information Security Program. Further mapping of employee work roles with the Knowledge, Skills, and Abilities (KSAs) helps to assure coverage sufficient to succeed or excel in a work role, and filling in any gaps with continuing education.

San Jose, Ca, Us

Developed, managed, assured adequate reviews, and maintained the Information Security Policies and Standards Library for PayPal worldwide access and use. Applied the requirements within the standards to establish and run an effective security training and awareness for 14,000 employees worldwide. Leveraged effective media and tools to create culturally- and geographically -appropriate Security Awareness and Training campaigns to help people understand that “Security is Everyone’s Responsibility.” Led the development and implementation of security awareness campaigns for Lock It When You Leave It, Compliance Jeopardy Game, an Information Security Related Haiku contest and in-person events that bring industry experts to PayPal to share their experiences and knowledge with PayPal software developers, Site Operations Personnel, and Information Security personnel. Our rotating Data Protection Weeks reach thousands of Call Center personnel with security training and security awareness that rapidly reminds them of their responsibilities for handling sensitive customer information and offers them a forum to answer specific questions -- given their limited time for training and contact.Using a variety of measurement tools to gauge the effectiveness of a campaign, we were able to prove that the Lock It When You Leave It campaign alone effected positive behavior changes in 65% of the participants we surveyed.

New York, Ny, Us

Established and implemented the Application Development Security (ADS) program for American Express which included developer training, rollout of IBM’s Rational Tools for source code analysis, Web app penetration testing program, and remediation authority for bugs and other security issues that were found.Responsible for inculcating the Application Development Security Program as a natural aspect in all phases of the Software Development Life Cycle at American Express.Created CBT courses and instructor-led courses for software developers, analysts and designers, and leaders of employees engaged in the SDLCLed a group of IT Security Subject Matter Experts in Project Governance activities that include Product Evaluations for proposed COTS implementation, development of standards, strategies, and prescriptive frameworks for reusable security servicesResponsible for conducting Proof-of-Concept evaluations on new IT Security tools to determine the suitability of use and supportCollaborated with CISO Office on policy enforcement mechanisms and joint reviews of CISO Policies and Standards and CTO Standards and Strategies for implementing IT Security Controls across the AMEX Enterprise.Developed IT Security Strategies for Enterprise Technology Roadmap using TOGAF tools and techniquesServed as American Express Technologies Representative to BITS/Financial Services Roundtable Security and Risk Assessment CommitteeServed as American Express Technologies Representative to the Financial Services Information Sharing and Analysis Center (FS-ISAC)Served as American Express Technologies Representative on Financial Services Sector Coordinating Council on Homeland Security and Critical Infrastructure Protection (FSSCC) R&D Committee and Cybersecurity Committee

New York, Ny, Us

Critical Infrastructure Protection for Finance and Banking CybersecurityBITS Security and Risk Assessment Committee as Executive Subcommittee Member and Member of the Lab Governance Committee (LGC) for Financial Institutions Data Evaluation Security (FIDES)Site Coordinator for Financial Services Information Sharing and Analysis Center (FS/ISAC)Developing and implementing policy and standards base for long-term security strategy and operationsSynthesis and migration of IT Security policy and standards library to RSA Archer Security Management PlatformAdvanced Payments (chip cards, RFID cards, key fobs) securityKey Signing Officer for AMEX related cryptographic keys and Certificate AuthorityProject consulting, issues resolution, and security exceptions dispositioning

Bachelor Of Science (Bs), Computer And Information Sciences, General

M.Ed., Distance Education And Learning Technologies

Ms, Decision And Information Systems