Tim D. Email & Phone Number

Philadelphia, Pa, Us

Remote

Performed multiple security roles by protecting the public's PHI while working on one of the leading government medical records systems. Embedded with multiple teams to act as a Security Lead for AppSec and DevSecOps duties including but not limited to: Secure Code Review, SAST/DAST/SCA, Penetration Testing, Threat Modeling, Secure Pipeline Automation (Jenkins & Github Actions), system image and container hardening, architectural security reviews, Created IaC for security tooling deployments (SonarQube, DefectDojo, etc), engineered automated gating for security checks within the development and deployment pipelines of applications for all internal tooling projects.Helped guide internal security processes within Flexion by creating playbooks and security best practice templates for easier and faster deployment of security concepts. Lead the internal Security Guild to help foster better security within other teams/roles.Mentored other developers, DevOps engineers, and Security engineers on security best practices.Utilized strong Agile practices while pairing and working closely with peers in a 100% remote environment.Developed many new pipelines/automations to ensure Security practices were adhered to throughout the entire SSDLC process.Key tech used: AWS CDK, Terraform, Jenkins, GitHub Actions, Snyk, SonarQube, Python, TypeScript, JS, Java

Remote

Transitioning from an Application Security Champion, now to focusing on Security Automation within Wells Fargo. My core focus is on automating the Application Security practices within Wells Fargo, and building them into the DevSecOps pipelines. This as well as bringing experience and guidance to the Security Program as a whole and leading the Software Composition Analysis practice, will further enhance the readiness of Wells Fargo's AppSec posture.

Remote

I was brought onto the Wells Fargo team to aide in their deployment of their Application Security Champion program. This involved the deployment of AppSec security policies across a large group of applications exceeding 150+, and grew to include over 500+. This involved working directly with the application engineers and owners to make SAST a standard process (HP Fortify), as well as advise on best security practices where applicable within the application SDLC process. Additional achievements included: creating a custom reporting script to tie into an existing security tracking application to get relevant data from it, as its built-in reporting was useless. I created a custom SQL Reporting server to tie in the previously grabbed data. I worked with the program creators to have enhancements to rule-packs and application configurations adjusted as issues were identified within the SAST process. I took part in an enterprise wide pilot for CheckMarx as a new SAST tool, having previous experience with this. I was able to ensure certain pitfalls were avoided prior to the production release. Often my guidance was sought after for larger "big picture" discussions as my past experience aligned with the goals at hand.

Chantilly, Virginia

I joined the PenFed team to bring my development and security backgrounds together and pioneer their Application Security program. In addition to leading the AppSec team, I continue to use my knowledge and experience to aide in bringing all of PenFed's security into the future.Since joining the PenFed team I've been able to accomplish the following:• Developed and Implemented automated static and dynamic application testing tools and procedures to make application security testing a standard process.• Developed secure baselines for multiple systems and applications that were lacking.• Trained teammates on introductory and advanced application security best practices and methodologies.

Chantilly, Va

Everything from developing security policy, policy enforcement and review, to penetration testing, mobile application development and reverse engineering. Whatever it takes to ensure client's data is protected from input all the way through storage and beyond.I've performed security policy and physical security assessments, been in and out of many data centers, and worked with many of the top software developers to ensure their applications protect our clients information.I've begun to focus more on mobile application security and how that affects our clients. From finding major security holes in applications, to directing them onto the right path of how to handle and manage data in a BYOD world.Other completed opportunities include:• Conducted on-site information security policy testing and interviews for many of a major international pharmaceutical / health care corporation’s business partners. This testing is to ensure the business partners comply with the requirements of the information security policy in order to protect proprietary and personally identifiable information and prevent disclosure.• Conducted information security policy compliance reviews on software and utility packages for a major international pharmaceutical / health care corporation.• Created a custom middleware programming interface for interacting with cryptographic devices (SafeNet iKey) and a virtual private networking (VPN) client.• Supporting the design and implementation of a SharePoint deployment for a major international pharmaceutical corporation, with a focus on maintaining compliance with HIPAA and internal information security policies.• Perform mobile application vulnerability testing and ethical hacking for enterprise level applications which handle access to business critical information.• Utilize manual and automated methods to perform vulnerability assessments and ethical hacking engagements on public and private facing web sites and web applications.

Honolulu, Hi

Spearheaded the migration from .NET 1.1 into .NET 2.0 as well as SQL Server 2000 to SQL Server 2005. Assisted in extensive SQL queries for massive reporting purposes. Created helper scripts for the QA department to use for better testing. General coding bug fixes.

Honolulu, Hi

Digital Mediums acquired Hirez Networks and that main software was frozen. From there I transferred my knowledge to developing websites, and interactive media for websites, trade shows, and kiosks (think of interactive shopping center maps, trade show kiosks or games). I implemented core application structures to template future work as well as direct implementations of website designs into websites (cutting and splicing psd).

Honolulu, Hi

Updated the main point-of-sale application for each customized revision based on customer needs. Created new modules working in C# and MS SQL. Worked directly with customers to gather user requirements and implemented those into the software. Created custom reports with Crystal Reports as well as lead new hires with code discovery sessions.

Master Of Computer Science, Computer Science

Bs, Information Technology