Stephen Burris Email & Phone Number

Palo Alto, Ca, Us

Minneapolis, Minnesota, Us

Washington, D.C., Us

San Francisco, California, Us

Member of a team responsible for validating remediation implementations from developers.- Provide feedback developers on the effectiveness of their solutions to vulnerabilities.- Led a team to revamp the Quality Assurance portion of our process.- Lead Developer for the next generation of tools during our agile transformation efforts.- Developer on web portal to interact and gather information from the lines of businesses.- Mentored developers and other AppSec professionals in various security area.

Charlotte, Nc, Us

Responsible for driving secure software development and testing practices with goal of protecting commercial and internal applications and data.- Developed training for engineering department on secure coding, focusing on common defensive measures and common vulnerabilities from OWASP Top 10 and SANS CWE Top 25.- Worked to get organization through its first PCI compliance audit.- Created 3-year plan to get AppSec program up and running to include SAST, DAST, and SCA components along with phased approach for each.- Enhanced existing SAST program and implemented repeatable processes to expedite pipeline.- Trained wider security team on source control, script development, and programming basics.- Mentored junior AppSec employee on security fundamentals and filled in gaps in knowledge.- Worked on multiple projects outside of primary responsibilities.

Responsible for designing and implementing the organizations Application Security Program- Standing up a SAST and DAST scanning programs.- Creating standards and guidance for development teams.- Build internal security tooling to help automate the collection and processing of scan results.- Working with the application development teams to ensure secure coding practices are implemented.- Perform Manual and Automated Code Reviews using Rapid7 AppSpider, BurpSuite, and Dependency Checker, Qualys SSL labs, and nmap.

**MicroFocus bought the software division of HPE.**Subject Matter Expert for the HPE Fortify Static Code Analyzer (SCA) tool, the WebInspect Dynamic Application Security Penetration and Scanning Tool, as well as the web-based collaborative Software Security Center (SSC) tool.- Worked with enterprise customers to design software assurance programs and deploy Fortify products.- Perform static code analysis of software applications written in a wide variety of programming languages including Java, C#, C/C++, and ASP.NET to fix potentially exploitable vulnerabilities at the root cause early in the software development cycle.- Designed and delivered classroom training for developers, testers, and technical leads.- Advised project managers and developers on secure coding practices, developing security metrics programs, and meeting compliance mandates- Provided training classes covering defensive programming techniques, using Fortify to find security issues in software, and meeting compliance mandates.

Randolph Afb, Tx, Us

Managed 14 government/contractor Department of Defense software assurance consultants. Helped incorporate secure coding standards to development shops’ Software Development Lifecycle.- Managed 14 personnel shop, led 4 person team, directly supervised 3 other team leads.- Provided mitigation strategies for 22K critical findings to 20 development shops/51 applications.- Selected to be on technical evaluation team for $17 million dollar contract.- Created secure coding training course, educated 212 developers, saved $550K in training costs.Tools Utilized:- HPE Fortify- IBM AppScan Standard- AppDetective

Randolph Afb, Tx, Us

Performed unit, integration, and system testing to validate accuracy of application modifications - Engineered prototype to ensure rebaseline of code meet all 17 area’s functional requirements.- Devised new user role management system, simplifying security management.

Managed 2 diverse software development teams consisting of 10 military, civilians, and contractors. - Steered team of 10 individuals, directly supervised and performed annual evaluations on five.- Guided change of Self-Inspection system, ensuring 5 MAJCOM oversight of 650K items.- Provided tier-3 level support to contracting system, enabling $1.5M in daily contract awards.- Engineered automated Air Tasking Order data system, eliminated 4 hours of manual input a day.Tools Utilized:- HPE Fortify SCA

Scheduled daily work orders for 250 members for 2.5K Air Force, and Presidential missions annually.- Created scheduling application, automated once manual process, saving 4.2K man-hours yearly.- Interfaced database with outlook to provide single dashboard showing manning to management.

Bachelor'S Degree, Computer Science

Associate'S Degree, Computer Science Technology