Rob H. Email & Phone Number

Los Angeles, Ca, Us

Basking Ridge, Nj, Us

Varied responsibilities on the Software Security Center-of-Excellence team include:• Providing enterprise-wide guidance on integration of key security tools into the CI/CD pipeline, including Open Source management (SCA/Black Duck), static code analysis (SAST/Fortify), and mobile security testing (MAST/NowSecure) tools• Onboarding mobile apps from Verizon's enormous mobile app portfolio to leverage a centralized automated mobile security assessment platform (NowSecure)• Defining mobile governance standards• Building security training programs to raise the security bar for Verizon development organizations, including secure coding, open-source management, and mobile security testing practices

Basking Ridge, Nj, Us

Responsible for securing strategic Consumer products, and building roadmap for efficient, scalable security processes• Performed security reviews for mobile and cloud applications built by Verizon Consumer Group• Collaborated on designing a shift-left strategy for collective Secure SDLC process carried out by product teams and Product Security team• Evangelized threat modeling as an essential Secure SDLC activity performed by both product and security teams to reduce risk

Tempe, Arizona, Us

Responsible for product security oversight and defining Secure Software Development Lifecycle practices used throughout a 1000-person organization with 70+ teams.• Educated numerous engineering teams on open source management best practices, empowering them to reduce risks in their releases.• Broadly improved compliance and familiarity with the Secure Software Development Lifecycle by founding an Application Security team of security-minded senior engineers, regularly delivering security training, reviewing threat models, and coordinating pen tests.• Established the company’s first external bug bounty, leading to the discovery of hundreds of vulnerabilities in NortonLifeLock’s websites, desktop, and mobile security applications.• Inspired the Global Cyber Security org to create a company-wide internal bug bounty for dozens of the company’s products, producing numerous high-sev findings.• Acted as the liaison between the Product Security Incident Response Team (PSIRT) and engineering, significantly improving responsiveness to externally reported vulnerabilities; reproduced reported symptoms, recommended mitigations, and drafted Security Advisories.• Significantly reduced risk of attacks against Norton websites and desktop binaries by elevating the priority of upgrading TLS and code signing certificates from SHA1 to SHA256

Tempe, Arizona, Us

Security Architect focused on mobile AppSec across the Norton Mobile Solutions organization, which delivers Norton's flagship mobile apps: Norton 360 on both iOS and Android.• Guided team to a 44% improvement in its Secure Software Development Lifecycle practices by identifying weaknesses and prioritizing improvements in threat modeling, crypto practices, open source management, security training, vulnerability management, and pen test management. Attained critical knowledge in mobile threats and mitigations.• Achieved 100% participation and pass rate for all engineers in company's 1st secure coding training program, 80% of whom were enthusiastic to take more challenging training.

Tempe, Arizona, Us

Responsible for driving all security activities within the team that delivers Norton Security – the company’s $2B/yr flagship security application for Windows.• Guided team to a 45% improvement in its Secure Software Development Lifecycle practices through security training and addressing gaps in threat modeling, open source management, static code analysis, and security testing• Conceived of and executed the company’s first internal bug bounty – at a substantially higher ROI from far more expensive external bug bounties and pen tests – improving product security and enabling engineers to gain highly valuable hacking skills. Built triage team, rewarded finders, and handed off security defects to the engineering team.• By expanding security influence from a single engineering team to the 1000-person Norton Engineering org, earned a Technical Director promotion and broad security responsibilities across the org.• Significantly reduced the risk of man-in-the-middle attacks against Norton Security’s network connections by researching and prototyping a certificate pinning solution and successfully lobbying with leadership to incorporate it into the product.

Tempe, Arizona, Us

Led all security activities for team that delivers the company’s browser extensions.• Facilitated a highly secure initial release of Norton Password Manager by driving all threat modeling, contributing secure design recommendations, incorporating static code analysis into the build process, and educating the team on open source best practices.

Tempe, Arizona, Us

Engineering Lead and Security Lead within Consumer Licensing Technologies (CLT) team; responsible for components used throughout Norton's Windows products that enable secure access to Norton's cloud and data-syncing services, event/messaging services, SSO/authentication systems, and inter-process SSO event notification. Responsible for team's Secure Software Development Lifecycle• First engineer to complete all required activities associated with the company-wide security audit. After becoming the first engineer to acquire threat modeling expertise, delivered org-wide threat modeling training and authored a best practices guide.• Given a strong performance during the security audit, elected as the company’s first full-time Software Security Architect; expanded security influence across the massive Cyber Safety Windows team responsible for the Norton Security flagship security product.

San Jose, California, Us

Architect and Security Lead for the team that delivered updating technology to all Symantec and Norton products. Technical leader for the group, with expertise in Win32 API, multithreading, IPC/COM, networking/HTTP/FTP, performance analysis and tuning, secure coding techniques, MFC, ATL, web server technology/ASP• With a ground-up design, delivered a new LiveUpdate client for desktop products, achieving a 90%+ size reduction, significantly lower CPU/memory usage, and a 90%+ reduction in update session time, while addressing security weaknesses of its predecessor.• Designed and implemented a fully automated update signing solution, leveraging cryptographic hardware, and satisfying FIPS standards. System remains virtually unchanged in nearly 2 decades of continuous operation; was the world’s first solution to secure dynamic software updates.

• Led the design of a satellite-based media distribution system that included creation and execution of custom schedules for displaying synchronized video media across multiple sites worldwide.

Armonk, New York, Ny, Us

Owned all UI design and implementation responsibilities for IBM AntiVirus -- IBM's #1-selling software product at the time• Designed and implemented secure internet communications components of the AntiVirus Immune System -- a first-of-its-kind automated massively-distributed AntiVirus analysis and response system... later sold to Symantec, becoming a core part of their Security Response service

Leverkusen, North Rhine-Westphalia, De

Member of a globally distributed team that created software that operates high-end automated blood analyzers used by laboratories around the world.• Implemented order entry, test result reporting and printing, and patient record management. In order to meet stringent FDA standards, the development process followed a very structured development lifecycle, following IEEE documentation standards.• Designed and implemented strict configuration management and source control systems.• Significant contributor in Windows development projects, and became a technical leader in this area, especially in user interface areas• Migrated source code from 16-to-32 bits on Windows platforms to support modern OS requirements

Bachelor Of Science In Engineering, Biomedical Engineering, Computer Science

Master Of Engineering, Biomedical Engineering, Medical Imaging, Computer Systems In Medicine