Patrick Toomey Email & Phone Number

San Francisco, Ca, Us

San Francisco, Ca, Us

San Francisco, Ca, Us

San Francisco, Ca, Us

San Francisco, Ca, Us

Mountain View, Ca, Us

Protect the Goog by hardening libraries from common vulnerability classes, assessing software before it is released, and working with development teams to architect their projects securely.

Chicago, Il, Us

● Promoted from Consultant to Senior Consultant to Technical Lead over the course of two and half years ● Performed hundreds of application security assessments and architecture reviews across a diverse set of software stacks (web based, compiled fat-clients, embedded systems) and languages (Java, C#, Ruby, Python, Objective-C, JavaScript, C, PHP, IA-32 assembly)● Initiated, designed, and developed an application to parallelize the collection of risk metrics across a large volume of web applications; this tool was used to help prioritize application assessments for clients and led to a new service offering● Developed software tools to automate assessments, demonstrate exploits, and foster research● Experience with reverse engineering/debugging binary applications and network protocols● Mentored/trained consultants to grow the team's application assessment capabilities

Chicago, Il, Us

Chicago, Il, Us

Chicago, Il, Us

● Developed course material and delivered a quarter long course on application security, with a focus on performing application security assessments (web applications as well as binary applications)● By the end of the course students were able to identify/exploit common vulnerabilities in open source software, develop appropriate remediation/mitigation guidance for the vulnerabilities identified, and implement basic shellcode within a Linux environment

Chicago, Illinois, Us

● Evaluated by supervisor as performing at a level commensurate with peers two grades more senior● Wrote security requirements for a secure boot mechanism as well as a protected debug facility for use on carrier grade infrastructure equipment; project involved balancing customer demands, product limitations, and negotiating customer buy-in● Developed a framework for testing Bluetooth behavior using the BlueZ Bluetooth stack● Performed a security evaluation on an internally hardened Linux/Java platform for mobile devices● Mentored an intern investigating susceptibility of ARM processors to cache based timing attacks; Leveraged C/Assembly for probing register/cache state, configuring page table entries, and writing test cases to exploit the timing variances● Initiated a research project in the area of embedded virtualization and domain isolation; 1/3 of the team was scheduled to be dedicated to this area in 2007-2008

Ft. Meade, Md, Us

● Wrote a buffer overflow exploit for a known flaw in Apache to evaluate the efficacy of contemporary memory protections (stack canaries, ASLR, non-executable pages, etc.)● Wrote a patch to expand, as well as fix several flaws with, Snort’s handling of IPv6 traffic● Developed a lab of numerous Linux and Windows machines running in a virtualized environment to evaluate several of the leading open source honeypots such as Honeynet, Labrea, and Honeyd● Used tools such as Nessus, Metasploit, VMware, Wireshark, Nmap, and Snort to perform a penetration test of the lab environment in an effort to learn the functional features and shortcomings in the leading honeypot technologies● Analyzed the legal issues that surround honeypots, especially as it relates to the National Security Agency’s mission

Chicago, Il, Us

● Deployed/Troubleshot Firewall Rules, Multicast, PGM, NAT, Routing, VLANs, HSRP, DNS, ISDN, Frame-Relay, SMTP, POP3, IMAP, ICA, router ACLs, and file/print services both internally and for clients● Developed in-house software tools used to diagnose, track, and catalog client networks using SNMP, WBEM/WMI, VBScript, and a MSSQL database● Architected and deployed networks for trading firms to provide connectivity to numerous vendor data feeds, branch offices, stock exchanges, and their associated trading floors● Developed the in-house customer database and GUI front-end (MS Access with extensive VBScript customization)

Mscs, Computer Science

Bsee, Electrical Engineering