Scott W. Email & Phone Number

Chandler, Arizona, United States

Tempe, Az, Us

Part-time instructor at Arizona State University's School of Politics and Global Studies.

Wilmington, Ma, Us

* Developed a risk-based security program which both aligned to industry best practices, such as NIST CSF and ISO27001 as well challenges posed by our specific threat environment.* Defined, developed, and deployed a comprehensive anti-malware strategy aimed at balancing protective and detective controls while simplifying our tooling and moving most detections from the endpoint to the perimeter.* Developed an aggressive security logging and monitoring program which employed traditional signature-based detection, advanced analytics, and curated threat intelligence, resulting in a clear, comprehensive understanding of activity within our security environment.* Matured an ad-hoc security operations process through an outsourced partner, significantly improving detections and alerting while decreasing the need for escalation and incident response.*Developed a documented, tested, and effective Incident Response Plan, including general Security and Privacy Response and threat-specific courses of action, and defined escalation processes from our managed SOC to our outside Incident Response firm.* Shifted from an ad-hoc penetration testing regime to an aggressive, ongoing testing process aimed at continuous improvement and more rapid detection.* Stood up an aggressive security awareness program which included ongoing phishing simulations, quarterly security awareness training, and role-based training.

Mesa, Arizona, Us

* Established a comprehensive written information security program which aligned to and was audited against a number of standards including PCI DSS 3.2, ISO27001/2, SOC2, NIST 800-53r4, CJIS and SOX.* Established and executed on an aggressive strategy aimed at modernizing and strengthening the overall Information Security Program including the deployment of overlapping, complimentary protective and detective controls aimed at both hardening our attack surface while increasing visibility to support early detection and response.* Built a Vendor Risk Management program which dramatically increased both our control and visibility of vendors while reducing the overall cost and overhead of management of vendor risk.* Updated, deployed, managed and successfully executed a written Business Continuity Program (BCP) based on DRII/ISO standards resulting in extremely successful outcomes.

San Mateo, Ca, Us

* Lead the Information Security Department responsible for defining strategic goals and objectives * Established numerous programs which resulted in a significantly improved security posture, increased visibility into security-relevant events and reoriented our incident response process* Collaborate with other business units to ensure that the organization is compliant with relevant regulations including HIPAA, PCI DSS, and SOX* Ensure the organization is able to succeed in an extremely security conscious environment and complex and rapidly changing threat landscapeHighlights:* Established a comprehensive written information security program aligning, as appropriate to ISO27001/2, NIST 800-53r4, and the 20 Critical Security Controls * Overhauled the incident response capability utilizing advanced detective, protective, and corrective controls along with a comprehensive incident response process based on the SANS 6-step process, and aligning with NIST 800-53, 800-61r2, and 800-86 as well as CMU and other best practices* Created an aggressive malware defense strategy that addressed risks posed by advanced threat actors and included detective/protective measures throughout the Cyber Kill Chain * Developed a comprehensive risk ranking of vendors by producing a proactive vendor security review program that included technical risk evaluations, security control reviews, and reviews of third party audit reports* Established a cutting-edge log management/analysis program * Established a comprehensive security-oriented asset management/configuration management program based on industry best practices

San Mateo, Ca, Us

* Oversaw numerous areas within the Information Security department including Incident Management, supporting Internal/External Security Audits, and Security Program Management* Subject Matter Expert (SME) that supported the Sales, Proposal, Client Services, and Professional Services Departments in answering security related questions for Requests for Proposals (RFPs) and third-party security assessments * Served as a customer contact and escalation point for follow-up questions and customer audits* Worked as a Data Loss Prevention (DLP) Investigator and Administrator responsible for tuning, monitoring, and managing user access on the DLP system * Monitored and rectified violations of privacy and security policies* Served as an Initial Incident Handler for privacy/security breaches and as the primary point of contact for the CSIRT team involving the identification of issues through administrative/technical monitoring tools * Administered the initial investigations comprising making an initial assessment as to the scope of the incident, directing immediate response actions, and expanding the response based on documented policies* Maintained the incident log and defined/generated reportable metrics based on standards * Supported internal/external and customer audits accountable for conducting physical and logical security reviews (both internally and for key vendors), customer security audits, source code reviews, penetration tests, and industry audits including PCI and SOX

As a consultant, I have taken on projects that were both challenging and rewarding. Working with small businesses and high-technology startups, I consulted as both an individual designer and developer and on teams of 20+ people involving many creative and technical disciplines. Though much of my work involved interface design and web development, I have also been involved in web application security, IT support services, and security reviews.Application security work for a number of customers included comprehensive reviews of web application design, including elements of the OWASP Top10. Beyond applying these standards to my own code, I was involved in making recommendations to improve identified issues, and rating risks based on likelihood of breach.IT support services involved setting up and configuring various types of networks, installation, configuration, updating of PC security software and installing patches for operating systems and firmware. I have also been involved in business continuity planning and disaster recovery planning. Finally, I provided general security reviews and recommendations for implementation of Content Management Systems, and other dynamic web tools such as blogs, galleries and online communications platforms such as webmail, online forums, and secure communications systems related to HIPAA compliance and patient communications.

My role at Terraspring was primarily to lead in the design and development of the customer facing website. The dynamic atmosphere of the company gave me the opportunity to work with many departments outside of marketing including Engineering, and IT Operations. In Engineering, I served as an interface designer for a data center virtualization system, which included network design, resource allocation, and real-time monitoring within a single application.

My initial assignment at Yack.com was to develop the user interface for an online community. Soon after the site was launched, I was asked to address numerous safety and security issues related to the community.Through a collaborative effort, I worked with the production and the IT teams to harden the application, server and infrastructure from external attack.Following the successful launch of the community, I was asked to lead an initiative to identify safety issues involved with the online community platform. As a result, we put a program in place to identify and disrupt people abusing the system, as well as a policy and procedure for reporting suspected predatory users.Finally, I was involved in the company’s preparedness and response to the Y2K bug by validating the front-end scripting and correcting the issues which were found.

Master Of Arts - Ma, Global Security

Certificate, Data Security And Privacy Policy

Certificate, Cybersecurity / Strategy

Bachelor’S Degree, Information Security And Risk Management

Certificate, Wemt

As, Fire Science