Speaker at BSides Charleston - "RCE Through the Supply Chain" - Exploring some techniques for crafting attacks delivered through the supply chainSpeaker at CypherCon 7 - "So I Heard You Want to Develop Generative AI Apps Now…" - A look at some risk areas when developing AI appsGuest on the Main Street Marketing podcast - Cyber Security & AISpeaker at BSides Charlotte - "AppSec & LLMs" - An overview of security risks related to using LLMs with internal applications

Just a group of guys playing some football when the weather is nice

As a member of the Software Security Group, I worked with the team to threat model and review new changes to applications and services. We also performed static and dynamic tests based on risk and worked with developers to assist them in building more secure code. We also were in the early stages of building out a proactive Red Team and performed quite a few pen test assessments ranging from container security to Kerberos to web app account management. Personally, I was excited to spend a decent amount of time in the software assurance space, performing software supply chain attacks.I mainly worked with teams that developed in Spring Boot, Node.js (Express), React (Next.js), and Kotlin.

As part of the Software Security Group, we were responsible for the security posture of all developed applications at Quad. Using the BSIMM framework and Microsoft SDL as guides, we focused on adding security controls to the existing SDLC. Some of the major accomplishments were onboarding applications to our SAST solution, aligning development policy with Compliance requirements, and launching a Security Champions group consisting of developers across the department.

On the SecOps team, we were responsible for the security of all of the IT assets at Quad/Graphics. My focus was mainly on application security, but I did do some firewall and VPN management from time to time.Having taken a few software development classes in school, I tended to wander my way into projects for automating day-to-day tasks in areas like vulnerability management, endpoint security, and even the web infrastructure. I was also a part of a group of analysts who built up a framework for running PowerShell tasks through a web GUI.

On the Web Systems team, I was part of a team responsible for the health and security of a few hundred different web applications in multiple datacenters across the globe. About halfway through my time on the team, I was promoted from Administrator to Analyst.A couple cool things I worked on:- Automating application deployment, including build out on the F5 load balancers and automated certificate generation through Comodo- Maintaining the SharePoint 2010 infrastructure, which included a project to utilize ADFS as the identity provider for our largest SharePoint sites

Prior to my time at Quad, I worked for a couple of Milwaukee-based companies in IT roles that focused on web, email, and print administration.