Scott Carmack Email & Phone Number

Seattle, Wa, Us

Worked closely with development teams providing security reviews of high profile externally facing web applications, web services, and client device integrations.Accountable for all security functions within the Software Development Life Cycle (SDLC) including complete end-to-end security reviews, threat modeling, functional and non-functional security requirements, architectural recommendations, code reviews, application penetration testing, and mitigation recommendations.Worked daily in a rapid, fast moving environment with unmovable deadlines such as launches tied to Super Bowl ads (PepsiStuff/Amazon MP3 points campaign), highly visible technology launch events such as Kindle, and Cloud Computing with AWS.Held multiple additional positions since 2007 including Lead Security Engineer, and Manager, Security Engineering, within the application security organization.

Seattle, Wa, Us

Managed an organization consisting of two separate teams, a software development team and a security engineering team including security engineers as well as software development engineers. Team tenure ranged from college hires to senior engineers with 15 years of experience.Architected and managed the development and execution of a closed loop complete source code scanning automation system providing discovery, issue tracking, alerting/messaging, automated escalation, and remediation confirmation with zero contact ongoing with security engineering.

Seattle, Wa, Us

Managed a senior team of application security engineers responsible in providing lean and fast consultations throughout the organization. The scale of our consultations would be measured in hundreds of applications.

Us

• Responsible for all security functions within the development lifecycle.• Communicated risk to the business at all levels of management including C level reporting directly to the CEO. This was accomplished through formal analysis and documentation of the risk and face to face presentations.• Produced enterprise wide documentation on secure application development including guidelines for developers and architects.

• Analyzed security architecture and design of applications including authentication and access control.• Performed application penetration testing and mitigation strategies.• Recovered systems when security prevented access due to forgotten passwords, corrupted authentication/authorization tables, and other 'circumstances'.• Coded custom applications using C++ and DirectX API’s for 3D visual animation of statistical and report data.• Architected security solutions including risk analysis, access controls, and business continuity planning.

Wrote software primarily in C++ in developing a Learning Management System (LMS) that was eventually acquired by SumTotal Systems.

A mixture of software development and security consultations.