IBM, Denver, CO 2004 to present.Senior Security ConsultantLarge Power Utility Companies: • Performed in-depth security assessment work including internal vulnerability scanning, internal network penetration testing targeted against multiple environments, external penetration testing, network architecture reviews, security controls reviews, and application assessments. • Obtained access to sensitive customer financial information and access to systems that could be used to disrupt business operations. • Identified severe holes in applications that could be exploited by customers to gain access to sensitive information and provided actionable recommendations for the client to remediate these holes. • NERC CIP cyber vulnerability assessment (CVA) methodology and supporting evidence review. • Conducted gap analysis and remediation of NERC CIP documentation and processes.Large Financial Institutions • Performed several web application assessments in which in-depth reviews and analysis were completed on these applications to determine weaknesses that could be exploited by a malicious attacker • Utilized a stringent testing methodology to assess these applications for vulnerabilities • Provided remedial recommendations to clients and retested applications after this remediation was completedVarious Retail Organizations • Performed in-depth security assessment work including security policy, vulnerability assessments, network architecture reviews, internal and external network penetration testing, application assessments, wireless penetration, physical security reviews and social engineering • Provided customers details of findings, how to remediate the findings, and industry best practices for enhancing the security of the organizationsIBM, Boulder, CO Summer 2003Security Research Internship • Developed curriculum to secure operating systems and services. • Developed secure coding practices for IBM programmers.