Steven Diyorio Email & Phone Number

Phoenix, Az, Us

Phoenix, Az, Us

Boise, Idaho, Us

Walnut Creek, Ca, Us

Responsible for developing and managing the enterprise Vulnerability Management program, Breach & Attack Simulation, Penetration Testing and Application Security focused on the reduction of risks to CSAA member privacy and data.

Walnut Creek, Ca, Us

- Developed a strategy and three year roadmap for the Information Security department including Governance, Risk and Compliance, Identity and Access Management, Security Monitoring and Incident Response, Security Engineering and Operations, Training and Awareness- Developed a technical roadmap for cyber security architectural components such as firewalls, intrusion prevention systems, data loss prevention systems, security information and event management systems, vulnerability management, web content filtering, file integrity monitoring and anti-malware.- Performed security evaluation and consultation for IT led projects, ensuring security in critical business systems- Conducted an enterprise architecture risk and gap assessment to identify key risks and gaps in security architecture- Created and documented a security reference architecture to drive a targeted maturity model for the enterprise

Walnut Creek, Ca, Us

Tapping into a long history in Information Technology and Information Security, I have served a wide variety of roles at CSAA that have contributed to a large amount of growth and maturity in the IT Security department.Key Contributions:- Led penetration testing efforts for several critical applications and provided consultation on remediation to reduce risks to production assets- Assisted in the progress of several engineering projects to deploy a wide variety of cyber security architecture components, including products supporting Data Loss Prevention, Next-Gen Firewalls, URL Filtering, Vulnerability Management, Host Threat Prevention, Intrusion Prevention Systems, Advanced Threat Detection and Security Information and Event Monitoring.- Provided consultation to engineering and operations teams on the development of security products and services that support and protect the business- Provided consultation to security management on the development and maturity of key processes and security strategy- Led efforts on security log source integration for Security Information and Event Management systems - Provided security consultation, engineering and design, and deployed security blades for a network edge redesign project, including the introduction of encrypted traffic inspection- Provided guidance and updates to security policies, standards and specifications- Conducted risk assessments and remediation guidance for internal applications, products and third party relationships- Led efforts to redesign and implement a Third Party Risk Management process, including the development of Inherent and Residual risk models, updates to policies and procedures, RSA Archer development and onboarding of a third party risk monitoring service- Assisted the IT Governance, Risk and Compliance group in the development of risk management processes, exception processing and remediation planning- Assisted in the development of RSA Archer modules

Houston, Texas, Us

Although my title was Technology Consultant for Hewlett Packard, I worked primarily as an Application Security Consultant performing risk assessments against several web and mobile applications and, working with several security team members, conducted penetration testing, static code analysis, static application security testing, dynamic application security testing and general security consulting for application teams and third party vendors.Key Contributions:- Assisted with the development of processes and tools that supported our approach to risk assessments, both internally and for external third parties. - Conducted security risk assessments for web and mobile applications- Provided security consultation for the development of HP products and services- Analyzed results from penetration tests, static code analysis, SAST and DAST reports and translated the information into actionable, risk rated, prioritized tasks that assisted in the reduction of risk for new and existing applications and products

Oakland, California, Us

As a Security Consultant in the Cyber Security/Technology Risk Organization at Kaiser Permanente I have performed enterprise network penetration testing, project security assessments and vulnerability analysis, third party security reviews and web application penetration testing resulting in the reduction of risk to KP member data and a large, heterogeneous healthcare network. The identification of application and system level vulnerabilities and the consultation on their remediation led to several projects implementing systems with built-in security, compliant with regulations and standards such as HIPAA, PCI and SOX.Key Contributions:* Performed varying levels of security assessments and risk reporting for up to 20 projects at a time resulting in a reduction of risks associated with common vulnerabilities that could lead to data exposure or system compromise.* Participated in team based enterprise penetration testing exercises to identify enterprise level risks and develop strategies to address wide spread vulnerabilities that could expose the business to internal or external threats.* Generated and presented risk assessment reports on security vulnerabilities for both technical and executive staff, representing risk in a comprehensive format with recommended actions for remediation or mitigation.* Reviewed complex healthcare systems designs and provided recommendations for securing data at rest and in motion to ensure proper due diligence in accordance with industry standards and regulation.

Oakland, California, Us

Led several successful projects selecting, designing, configuring, deploying, maintaining and supporting Information Security products contributing to the overall enterprise security architecture at Kaiser Permanente. Key Examples of Experience:* (Desktop Encryption) - Responsible for architecting a desktop encryption solution for over 250,000 Windows workstations to protect sensitive data in case of loss or theft. Designed the first distributed file system and data synchronization architecture at KP, leading to a significant reduction in bandwidth utilization and providing innovative fault tolerance and backup capabilities.* (Data Loss Prevention) – Led engineering team in the deployment of a Data Loss Prevention solution that can monitor and prevent sensitive data loss for data in motion, at rest and in use.* (Host Intrusion Prevention) – Configured, managed and deployed Host Intrusion Prevention to assist in the discovery and prevention of malware infection based on signature analysis, behavioral analysis and stateful firewalling.

Oakland, California, Us

Maintained a network engineering role designing, deploying and managing network security services such as firewalls, virtual private networks, network authentication systems and wireless security components.Key Contributions & Results:* Managed perimeter and business partner firewalls and internal intrusion detection systems.* Deployed the first transparent firewall for the Downey Pharmacy Department.* Designed and deployed the first national (multi-region) virtual private network to increase productivity and mean time to repair for business partner Kodak supporting KP biomed devices.* Wrote the KP Wireless Technical Security Standards governing secure configuration of widely deployed wireless access points.

Oakland, California, Us

Participated in various projects, providing general security guidance while leading efforts to establish a developing security architecture. Key Contributions & Results:* Established technical security standards for web application servers.* Developed a patch management program to monitor, categorize and establish criticality ratings for enterprise software security patches.* Provided general security consulting to projects with data privacy concerns.

Responsibilities included the design, project management, installation, and account management for regional network related projects.Key Contributions & Results:* Led a large project to replace hundreds of 3com routers and switches with Cisco LAN equipment * Significantly improved network performance by auditing and reconfiguring OSPF routed network with optimal settings* Designed and implemented network equipment status and performance monitoring system * Technical lead for regional and enterprise disaster recovery planning

* Deployment and management of network equipment for local exchange carrier backbone* Deployment and troubleshooting/repair for customer premise equipment providing business grade internet service* Deployment and management of customer network infrastructure