Nick Hawley, Cism, Cgeit Email & Phone Number

• Managed a high-performance team of engineers:• Project execution and management this included staffing, project management, and budgeting.• Projects included a full range of security services including: Threat Modeling; Web Application Penetration testing; Thick Client Penetration testing; IOT Penetration Testing.• Consistently achieved >95% promoter on post-project NPS surveys.

San Francisco Bay Area

Managing Consultant responsible for project delivery, client management, staff development, and sales. Key accomplishments include:• Managed Synopsys SIG South Bay Area consulting practices this include• Consistently Met or exceeded revenue goals.• Working with sales organization to identify client opportunities and translate those opportunities into won opportunities;• Projects included a full range of security services including: Strategic software security consulting and program development; Threat Modeling; Penetration Testing including Web Application Penetration Testing, Thick Client Penetration Testing and Embedded Penetration Testing.• Consistently achieved >90% client satisfaction on quarterly client surveys.• Delivered Building Security Maturity Model (BSIMM) assessment and consulting services for over 10 premier Silicon Valley technology clients.

Sunnyvale, Ca

Brought in during the first budget year of the Information Security Program at Intuitive Surgical for the purpose of building the Information Security program from the ground up in a highly virtualized environment. In this role I have:• Developed a security strategy for application deployed into cloud service provider environment. • Developed a Security Incident Response program• Developed and executed a security vulnerability management program.• Developed a vendor management process;• Developed a Security Assessment Process;• Identified key security vendor partnerships in the security and healthcare industries to streamline the procurement of systems and services. • Established malware monitoring and response strategy• Provided ongoing monitoring and situational awareness of emerging threats to executive management.

• Managed a highly skilled team responsible for application security/penetration testing. o This team was responsible for assessing security threat/risk throughout the program life cycle; o Defining and validate application security requirements definition and analysis; and o Implementing secure systems and processes using COBIT, ISO 27Kx, and ITIL standards. • Delivered a risk based metrics application to senior management, which measured Seagate’s application security health against industry standards (WASC and OWASP), and Seagate historical baselines over time. This improved Seagate’s response to threats by elevating management awareness. • Optimized and automated security assessment process. These design optimizations resulted in increasing project throughput by 400% and resource utilization by 200%.• Developed an enterprise Security Awareness Program for Seagate, which decreased user phishing susceptibility by 400%• Performed security due diligence reviews on Merger and Acquisition candidates to identify potential vulnerabilities and risks associated with the candidate.• Represented Electronic Security on cross-functional executive teams including, the Vendor Management Team, Information Protection Steering Committee, and the Information Security Awareness Core Team. This responsibility included: o Drafting and communicating security requirements, o Ensuring that these security requirements are appropriately applied, o Negotiating with teams and with vendors.

• Managed all aspects of the information security program. This security program considered the Graham-Leach-Bliley Act (GLBA), Health Industry Portability and Accountability Act (HIPAA), Sarbanes-Oxley, as well as applicable state and local regulations for 6 western states. • Coordinated and managed internal and external audit activities.• Provided reporting and guidance to management by participation in the ABD Compliance Committee and the ABD Risk Management Committee.• Provided consulting and guidance to business unit management on security and compliance. • Advised and assisted IT in deploying new security products. • Assisted in the development and review of the information security program for parent company

Responsible for full project management lifecycle including: Proposal and RFP response, negotiating and drafting statements of work, staff oversight, project budgeting and delivery. Projects have included:• Multi-Disciplined, Highly Technical IT Audit for leading technology security provider. Delivered multiple SAS - 70 reports for a wide variety of services client provided to external customers. Reports included:o BS7799 Report which is an international standard on security and controls based on ISO 17799, ando Multiple WebTrust for CA reports, which certify compliance with the RFC 3279.• Audit Readiness Review and Delivery of an IT Audit (SAS no. 70) for large educational loan provider. Evaluated client security environment against industry leading practices. Drafted control objectives and procedures, based on preliminary review. Performed audit against controls.

Managed teams through the full project lifecycle of identity management solutions, security assessments, attack and penetration testing on network infrastructure and OS components, and security best practices consulting services.Projects have included: • Successfully managed a team through the design and implementation of an integration between CA (Netegrity) Siteminder and Oracle (Oblix) Identity manager for a major automotive manufacturer. This implementation served a user constituency of over 8 million users. • Successfully designed and implemented a provisioning system utilizing Microsoft Meta-Directory Services. Performed a third party partner assessment, which client required prior to turning over Symmetric encryption keys. This Project involved testing a potential partner’s network security infrastructure based on criteria defined by client.

Peformed Network Management and monitoring for a 250+ site Wide Area Network.