Owen Mccarthy Email & Phone Number

Mexico, Ny, Us

United States

• Took on ownership of Semgrep, Floqast’s SAST. Created rules to detect application security vulnerabilities from up-to-date attack techniques and worked with developers to streamline the CI/CD process and remediate vulnerabilities. Gave trainings to the developers and security team on secure coding practices, RBAC, LLM security, JWT security, and secure error messages with interactive demos and CTFs.• Took on ownership of FloQast’s HackerOne bug bounty program and launched an authenticated program. Looked over every finding that was reported, and delegated further investigation to the team when necessary. Wrote in-depth responses and guides for findings that were invalid or false positives, including documentation, resources, and guidance to help researchers to learn more. Worked with developers to fix vulnerabilities, including draft pull requests or meetings to discuss the findings on a technical level when necessary. Worked with Staff Engineers from across the company, as well as working closely with the DevOps team to deploy an AWS environment dedicated to the authenticated bug bounty program and to get an identical copy of the application working in that environment.• Architected and implemented a new system to make environment variables and URLs modular in the application so that the DevOps team can deploy new environments, including the one for the authenticated bug bounty program, with one pull request to a centralized environment information repository, rather than individual changes for each repository. Met with stakeholders across the organization to make sure their needs were met and that the solution was as simple as possible, and worked with them to increase adoption with each team.• Identified IDORs and vulnerabilities in the application's JWT validation, user setup, and user document uploads through regular penetration tests and remediated the findings, putting systems in place to prevent the vulnerability from being reintroduced in the future.

Fremont, California, United States

• Worked on the Platform Security team to engineer new cyber security infrastructure and practices at Tesla• Experienced professional communication and management practices, as well as a trip to RSA 2020 to keep up with modern security practices and technologies• Led meetings with cyber security vendors