Reid Ashbridge Email & Phone Number

Working with clients to perform end-to-end application security assessment for web, thick-client, web services and mobile applications. This included consulting with clients to: scope engagements to meet their security needs, handling logistical and scheduling issues, managing communication plans, performing application security testing, writing reports to document the results of the engagement and leading post engagement discussions to clarify the results and recommended remediation.- Acted as the technical lead for large enterprise engagements to provide the client sponsors and stakeholders with a single point of contact for technical aspects of the program.- Engaged with the client’s technical teams to perform risk analysis and define the engagement scope to address critical areas of risk in their applications.- Defined framework to classify security findings into categories that correlate to actionable, strategic steps to prevent the same vulnerability classes from reoccurring in future releases.- Consulted with sales teams to provide technical pre-sales support for application security testing service offerings.- Worked directly with client’s infrastructure and development teams to define security issues and identify remediation options.

Dynamic Application Security Testing (DAST) of web and thick client applications for Fortune 500 organizations.- Identifying and validating vulnerabilities with both automated and manual testing techniques.- Contributed to training modules used to teach standard application testing methodologies.- Communicated vulnerability details, remediation strategies and associated business risks to clients.

Perform design and architecture reviews of mobile applications and services, facilitate security testing of mobile applications and coordinate resolution of vulnerabilities with Product Development teams.- Developed and implemented a methodology for testing mobile application security, which resulted in the identification and remediation of critical server and client side security issues.- Wrote secure mobile application development standard to provide product teams and developers with guidelines for securing mobile applications.

Responsible for the assessment and review of enterprise level projects to identify security requirements, provide support in designing secure solutions, evaluating risk and testing application security.- Created an application security testing framework with gap analysis to identify future improvements to better align existing processes with a Secure Development Lifecycle.- Defined and integrated standard software security requirements into the secure development lifecycle- Collaborated with security team members and program management organization to establish a Secure Development Lifecycle which integrated: security design review, testing and risk management into the software development lifecycle.

Acted as the lead technical advisor for all UNIX systems SOX and PCI compliance efforts. Participate in an on-call rotation as a member of the Computer Security Incident Response Team (CSIRT) to identify, assess, and resolve security threats to the corporate network. Performed vulnerability assessments on internal and external systems, analyzed results and work with business to resolve critical issues.- Designed and tested all remediation plans, evaluated software solutions, implemented host based auditing/access control systems and coordination with system owners to minimize impact to production applications for initial SOX and PCI technical control implementations.- Automated the collection of audit files and coded data parsing programs to support reporting for controls against SOX and PCI database and OS monitoring requirements.- Scripted process for the collection of forensic data on UNIX systems. Automation of the forensic process provided a standard and minimal footprint solution to quickly respond to potential incidents and ensure the appropriate information was collected prior to the recovery stage of incident response.

Provided tier 3 support of production UNIX business systems. Day to day responsibilities: disk maintenance, system monitoring, account creation, automation of recurring processes, patching, documentation of system standards/procedures and performance tuning.- Implemented systems, processes and developed scripts to facilitate secure transfer of sensitive data between T-Mobile and their business partners.- Configured the default build processes for Unix systems to reduce unnecessary services, enforce strong access controls and audit user access to meet security standards and compliance guidelines.Performed security audit of critical Unix business systems identifying and documenting potential gaps in SOX compliance prior to third party audits- Designed, built and deployed high availability clusters to ensure the continuity of critical business processes.

Provided 24X7 tier 2 support for the billing system, activation systems, text messaging system, and all internally developed UNIX applications. This position involved troubleshooting application issues with the end-user in order to resolve the issue, or facilitate a resolution with the development team.