Brian Donohue Email & Phone Number

Bellingham, Washington, United States

Private at this time

Bellevue, Wa

Consulted with client in efforts to build automation around GRC elements; in particular, Windows and Linux baselines from disparate sources were combined to create a minimum set of operating system baselines suitable for interaction with engineering automation. Applied my risk experience to high-level analysis of security controls to enhance management decisions regarding prioritization of organizational security focus.

Bellevue, Washington, United States

• Collaborated with internal stakeholders such as IT, finance and legal teams to evaluate the effectiveness of existing controls against established guidelines• Identified opportunities for process improvements within the organization's operational environment through analysis of current processes and procedures.Contract ended without renewal due to issues outside my control.

Member of a small Security Operations team in a company in the process of maturing internal security processes from a startup state. Essentially, this means we built a security program from scratch, with two engineers and a manager collaborating on all aspects of the work. This work included, but was not limited to:• Participation in the development of policy and procedures for auditability• Developed processes and approaches to assess risk and prioritize actions, beginning with uplifting vulnerability management processes.• Invented a unique risk assessment tool to generate risk metrics for executive review. • Developed processes for prioritizing actions to become compliant. • Built analyses and reviewed with DevOps engineers to develop action plans for problem remediation. • Built processes for policy exceptions and security reviews and worked with engineering in both areas.

Redmond, Washington, United States

As part of the Azure Security Monitoring team, I developed baseline requirements for both internal and external Azure customers. This involves review of both internal policy & standards and review of industry standards such as CIS, NIST, PCI, HITRUST, etc. to determine, for each technology reviewed, what requirements are appropriate for a given environment. The determination utilizes a risk-based review process of my own design. Technologies evaluated include, but are not limited to, MS Windows, multiple distros and versions of Linux, Docker, Kubernetes, VMSS, SQL Server, IIS, as well as networking requirements for internal and subscription environments. Baseline development extends to baseline design, development, implementation, compliance reporting, remediation for non-compliance, recommendations for collection of events and logging for alerting and incident response, and in the course of all this, interaction with a great many people and teams.

Redmond, Washington, United States

As a member of Online Services Security and Compliance, participated in a team effort to align risk with governance in support of leadership prioritization of security initiatives. Researched and analyzed environmental issues and quantified risks formally. Authored security configuration baselines for a very large internal infrastructure. Participated in the development of organizational policy and standards. Supported many teams in review and implementation of security requirements.

Redmond, Washington, United States

As a member of the Microsoft Advertising Security team, I worked to converge and secure an acquired company (aQuantive) into Microsoft Advertising. This included all aspects of operational security, including monitoring and reporting on key security initiatives in any given time period. It also included a form of incident response that was unique to the online advertising business of that period.

Seattle, Washington, United States

As a member of a small team focused on securing both internal user networks and data center infrastructure, acted as a security generalist with a focus on operating infrastructure firewalls for 20+ branch offices worldwide. This company was acquired by Microsoft one year into my tenure.

Seattle, Washington, United States

As a member of the UW Medicine Security team, I worked to secure an infrastructure that existed entirely on public IP space. This included design and deployment of specialized firewalls for medical devices, deployment and management of host-based firewalls on hosts used in patient care, design and deployment of security tooling for data centers, and extensive incident response across multiple locations.