Summary

Application security engineer with 6+ years finding and fixing vulnerabilities in web platforms and APIs. Comfortable partnering with product and platform teams to ship secure code without slowing delivery.

Skills

• Burp Suite
• OWASP ASVS
• Python
• threat modeling
• secure code review
• CI/CD security
• AWS
• Kubernetes

Certifications

• OSWE (Offensive Security Web Expert)·Offensive Security

  2023

Experience

• Senior Application Security Engineer·Northwind Security

  Remote · EU

  2021 – Present

  • Led web and API assessments for customer-facing products; reduced critical findings by 40% YoY.
  • Built secure SDLC gates in CI (SAST/DAST) and threat modeling for new features.
  • Mentored engineers on OWASP ASVS and bug bounty triage.

• Penetration Tester·Helix Consulting

  London, UK

  2018 – 2021

  • Delivered external and internal assessments for finance and SaaS clients.
  • Authored reproducible reports with clear remediation paths for engineering teams.

Projects

• Secure SDLC checklist (internal)

  Python, GitHub Actions, Semgrep

  • Maintained ASVS-aligned gates and dashboards for 12 product teams.

Education

• BSc Computer Science·University of Manchester

  2018

  Focus: systems security, cryptography

Summary

Security leader with 15+ years building programs that scale with product growth — balancing risk, compliance, and engineering velocity. Track record of board-ready metrics, budget stewardship, and hiring diverse security teams.

Skills

• Program management
• GRC
• AppSec
• cloud security
• budget & vendor management
• SOC 2/ISO 27001
• incident response
• executive communication
• hiring & mentoring
• M&A security diligence

Experience

• Director of Information Security·Brightpath SaaS

  Seattle, WA · Hybrid

  2019 – Present

  • Scaled security program from 12 to 45 FTE; established product security, GRC, and MDR partnerships.
  • Owned $4.2M annual budget; delivered SOC 2 and ISO 27001 with zero major findings in last cycle.
  • Partnered with CTO and sales on enterprise deals; reduced security questionnaire turnaround by 50%.

• Head of Security Engineering·Cascade Payments

  Portland, OR

  2014 – 2019

  • Built AppSec and cloud security functions; introduced bug bounty and tabletop exercises for leadership.
  • Led incident response for payment processing outage; improved MTTR and customer comms playbooks.

Education

• MBA · Technology Management·University of Washington Foster School

  2014

  BS Computer Engineering, Oregon State University · 2008

Certifications

• CISSP·(ISC)²

  2016

Awards & honors

• Security leadership award·Pacific Northwest CISO Forum

  2023

  Recognized for cross-functional security culture programs and measurable risk reduction.

Summary

Junior pursuing computer science with hands-on lab work, a municipal security internship, and active participation in campus cyber club and CTF events. Seeking entry-level SOC, IT security, or junior engineering roles.

Skills

• Linux
• Python
• Wireshark
• Nmap
• Git
• HTML/CSS
• Java
• technical writing
• teamwork
• TryHackMe
• Hack The Box (beginner)

Education

• BSc Computer Science (expected 2026)·California State University

  2026

  Relevant: network security, algorithms, operating systems · Dean’s list

Projects

• Campus cyber club CTF toolkit

  Linux, Python, Docker

  • Documented lab images and write-ups for weekly beginner-friendly challenges.

Experience

• Cybersecurity Intern·City of Riverside IT

  Riverside, CA

  Jun 2025 – Aug 2025

  • Assisted vulnerability scanning and asset inventory for municipal web properties under supervisor scope.
  • Drafted user-facing phishing awareness tips published on the intranet.
  • Shadowed SOC shifts and documented alert triage steps in a shared wiki.

• Teaching Assistant · Intro to Networking·State University CS Department

  Riverside, CA

  Jan 2025 – May 2025

  • Held office hours and graded labs on TCP/IP, DNS, and basic Linux administration.
  • Ran a capture-the-flag review session for 40 students.

Volunteer

• Cyber club member·CSU Cybersecurity Club

  2024 – Present

  • Organize monthly CTF nights and mentor first-year students on Linux basics.

Summary

GRC professional with 8+ years running audit programs, control frameworks, and policy ownership for regulated healthcare and financial services. Clear communicator between auditors, legal, and engineering on evidence and remediation.

Skills

• SOC 2
• ISO 27001
• NIST CSF
• HITRUST
• risk assessments
• policy drafting
• vendor due diligence
• ServiceNow GRC
• Archer
• audit evidence
• SOX ITGC basics

Experience

• Senior GRC Analyst·Meridian Health Systems

  Chicago, IL · Hybrid

  2020 – Present

  • Own SOC 2 Type II and HITRUST audit cycles; coordinate evidence collection across 18 control owners.
  • Mapped policies to NIST CSF and ISO 27001; reduced audit findings by 30% over two cycles.
  • Facilitated risk assessments for new SaaS vendors and tracked remediation in GRC platform.

• IT Compliance Specialist·Great Lakes Mutual Insurance

  Milwaukee, WI

  2016 – 2020

  • Maintained policy library (acceptable use, data classification, incident response) with legal and HR review.
  • Supported internal audits and external regulator inquiries with traceable control narratives.
  • Implemented access review workflows for privileged accounts and third-party integrations.

Education

• BS Management Information Systems·University of Wisconsin–Milwaukee

  2016

  Coursework: risk management, business law, systems analysis

Certifications

• CISA·ISACA

  2021

• CRISC·ISACA

  2023