Tracy Vandemark Gauger, Cissp, Gwapt Email & Phone Number

Boise, Idaho, US

Herndon, VA, US

• Provided application security as a service to clients in public & private sectors, multiple industries.
• Assisted clients in building an application security program from the ground up.
• Performed application security assessments using SAST, DAST, SCA and penetration testing.
• Wrote reports regarding vulnerabilities found, including evidence and recommendations.
• Analyzed automated appSec tool findings against code base to rule out false positives.
• Collaborated closely with application security tool vendors for the benefit of clients.

Portsmouth, NH, US

• Met regularly with dev teams to manage appsec expectations, documenting for audit evidence.
• Analyzed SAST and DAST results to rule out false positives.
• Performed manual application penetration testing and documented findings.
• Managed 3rd party pentest engagements, reviewed results, verified remediations.
• Discovered exiting bug in Python script in use to record findings, remediated it.

• Managed WAF program, expanded coverage.
• Performed security assessments of existing and under-development web applications.
• Worked closely with network, infrastructure, development and business teams.
• Addressed cybersecurity tickets including network firewall requests.
• Attended Change Advisory Board meetings to shepherd WAF change requests through to approval.
• Presented at steering committee for and coordinated launch of user phishing training tool.

Saint Paul, MN, US

• Performed Security testing on proprietary web applications to uncover vulnerabilities.
• Demonstrated exploitability of identified vulnerabilities as appropriate.
• Wrote reports to communicate vulnerabilities and remediation recommendations.
• Utilized Burp Suite, AppScan, Veracode, Nmap, sqlmap, Metasploit and Kali Linux tools.
• Presented security awareness topics at every new employee orientation.
• Performed AD password audit, uncovering insecure password and getting them hardened.

Saint Paul, Minnesota, US

• Performed Tenable compliance scans, after tailoring audit files to company standards, to harden OS.
• Conducted IAM user attestations for applications not migrated to SailPoint IIQ.
• Oversaw application password compliance audit.
• Managed the PhishMe phishing security awareness program and designed and presented training.
• Compiled weekly vulnerability reports based on Tenable scan results, noting outstanding exceptions.
• Performed third party SOC complementary user entity control mappings.

Santa Clara, California, US

• Worked within Agile methodology dev team throughout entire SDLC from requirements to release.
• Planned and performed application testing and root cause analysis via logs and code base.
• Performed feature, proliferation and regression testing across multiple platforms and releases.
• Successfully utilized and augmented proprietary test automation software using Perl.
• Documented software defects found during testing, using various bug tracking programs.
• Verified checked in fixes to ensure customers would no longer encounter issues.

• Learned and extended existing test vehicle written in C.
• Effectively developed test tools in C, on both Windows and Red Hat Linux platforms.
• Used CORBA to develop a test tool, which integrated Windows and Linux machines.
• Created test plans, including test requirements and procedures.
• Tested Illumina clustering appliance over the course of 4 release cycles.
• Effectively analyzed Java exceptions found through testing.

Bs, Computer Science

Bachelor Of Arts (B.A.), Psychology

Education record