Stephanie Sherwood Email & Phone Number

Delivering white-glove technical support, administrative, and security services to a large customer base in a fast-paced MSP environment. Helped raise security awareness, create an internal blue team, and implement new or existing processes to better respond to security incidents. Improved standards and understanding of internal knowledge base structure, features, and processes improvement, borrowing heavily from ITIL knowledge management principles. Bulk of administrative work involves M365, server, endpoint, and email administration. Leveraging ConnectWise, Addigy, Kaseya, Immy.bot, and other MSP oriented software to deliver service.

Seattle, Washington, Us

Performed a variety of application security, and more broadly, software security assessments on traditional web applications, databases, cloud hosted applications, cloud platform services, and hardware based systems for a diverse clientele, including well known greater Seattle area based technology companies. Executed assessment planning, testing, documentation, remediation consulting, and deliverable creation during solo and team based assessments.

Us

Collaborated closely with traditional enterprise security, DevSecOps, developers, and management teams on green field app development on the AWS platform to bring best practice and compliance aware security to both the platform and application. Educated on digital transformation, CI/CD, and DevSecOps to bridge regional in-house mid-sized enterprise thinking to modern cloud-enabled development, operations, security, and national application delivery thinking.

Oklahoma City, Oklahoma, Us

Held multiple roles with the last role as an embedded full-stack security engineer within the Health Data Science & Clinical Informatics department. Delivered threat modeling, security architecture, cloud security, and Secure SDLC improvements. Provided enterprise/IT department security architecture and guidance for Microsoft 365, Azure, general cloud, and infrastructure. Performed attack simulations, application security assessments (DAST, SAST, IAST, manual code reviews), and penetration tests. Scoped and managed third party penetration tests. Created and managed findings. Created and communicated risk treatment, mitigation, and remediation strategies for audiences ranging from analysts to the CISO and his peers. Delivered purple teaming services in collaboration with blue team. Developed repeatable MITRE ATT&CK based scenarios, leveraging AWS and hybrid cloud infrastructure, Docker, bots, FOSS, automation, and integration with SIEM/SOAR platform. Designed, deployed, and operated phishing simulation and security education programs.

Delivered varied information security services, largely penetration testing, for several clients.

Tulsa, Oklahoma, Us

Developed new frameworks, processes, and communication strategy for internal red team and threat intelligence programs. Championed risk management practices and information security management system utilizing an ISO 27000/COBIT/NIST hybrid model and GRC platform. Performed local and cloud security reviews. Scoped and performed penetration and red teaming exercises.

Fremont, Ca, Us

Developed new frameworks, processes, and communication strategy for internal red team and threat intelligence programs. Championed modern risk management practices and information security management system utilizing an ISO 27000/COBIT/NIST hybrid model and GRC platform. Performed local and cloud security reviews. Scoped and performed penetration and red teaming exercises.

Denver, Co, Us

Provided pre and post–sales support to existing clients for various security appliances and software in a Sales Engineering role. Generated new sales leads and grew existing client relationships. Created and delivered presentations on a variety of security topics. Performed penetration testing and application assessment services. Developed and delivered custom security policies for multiple clients.

Denver, Colorado, Us

Executed security services including internal and external vulnerability assessments, internal and external penetration tests, wireless vulnerability assessments and penetration tests, phishing attacks, phone based social engineering, in–person social engineering, physical security assessments, PCI related assessments, and full red team engagements. Created, reviewed, and delivered comprehensive reports for executives, technical resources, and everyone in between. Improved testing flexibility, reduced travel costs, reduced customer cost, and increased billable hours for security assessments by creating and maintaining a secure and standardized Linux penetration testing distribution and supporting infrastructure.

Oklahoma City, Oklahoma, Us

Developed and delivered presentations on security awareness topics for all audiences. Developed and taught a security professional training program. Developed policies, standards, procedures, metrics, and reporting for risk management, risk assessments, risk analysis, vulnerability assessments, vulnerability disclosure, application assessments, and host configuration assessments. Performed application security assessments, configuration assessments, vulnerability assessments, and risk assessments. Operational responsibilities included incident response lead, vulnerability management lead, and daily management of nCircle IP360, nCircle SIH, SourceFire, Palo Alto NGFW, and Microsoft PKI. Worked on DMZ and other network segmentation and security projects. Deployed and administered Cisco ASAs, Checkpoint FW, McAfee Enterprise, Microsoft PKI, Palo Alto, nCircle IP360, SourceFire, ArcSight, Imperva, LogLogic, Proofpoint, ActiveScout Edge, Packeteer, and other solutions.

Created and maintained policies. Created vulnerability management program. Performed password auditing, system hardening, awareness training, and executive education. Centralized logging. Maintained switches, routers, firewalls, servers, workstations, storage devices, remote users, load balancers, and everything else.

Computer Engineering

Education record