Renovating my property in East Los Angeles to enable what comes next.

I was security hire #1 at Signifyd and my first task was to take on organization pain points in achieving repeatable SOC 2 Type II and level 1 PCI-DSS compliance certifications. I single-handedly built out processes and systems to support risk assessments, vulnerability management, training, incident response, vendor assessments, log collection, and detections. Later I was able to staff a small team and zoom out to perform a comprehensive gap analysis, then collaborate with engineering, IT and other departments on projects to address accrued security debt: application secrets storage, software dependency management, strong authentication everywhere, and protection of customer data. This company posed unique challenges due to the sheer volume of data, extensive use of vendors, lack of traditional perimeter, and extensive attack surface.

Initially responsible for vulnerability detection (using IP360, Qualys and open source tools like nmap), I was able to increase coverage by working with IT to scan additional networks and authenticate the scans. I regularly worked with system owners to patch systems. I also recommended Duo to management to increase VPN authentication strength, and worked with IT to roll this out to thousands of employees. In 2019 took on PCI-DSS audit responsibility and worked through many speed bumps to pass the audit, including improving security awareness training and measuring phishing click rates with Knowbe4.

This was a wear-many-hats position that offered much freedom to internally consult to fellow employees on process and system improvements. Some of the hats: network engineer, firewall admin, sysadmin, and security engineer. Officially I was responsible for keeping network, firewall and server infrastructure humming, in support of centralized log collection and analysis to ensure availability and security of various managed services.

I worked as part of a small team to turn a SSL VPN software product into a fully managed and monitored service. This required daily collaboration over a 2 year period with software developers, product managers, QA testers, support engineers, and others to design, build and operationalize the service offering. Once operational, my focus turned to maintaining availability and security of a web application supporting the service.

I supported six internal applications, gaining an intimate familiarity with both SQL and Solaris in furtherance of availability and recoverability, while collaborating with developers on system upgrades.

This was a highly repetitive job which taught me the value of automation early in my career, implemented here mostly in Perl and cmd.exe batch files.