Security Developer
Cloud solutions architect at
Chain Security
| 2018-2021 | Remote & On-site
At Chain, I specialized in cloud security and DevSecOps practices, ensuring that our clients'
applications and infrastructure were secure by design. I worked closely with development teams
to integrate security into the CI/CD pipeline, conduct threat modeling, and implement security
best practices.
In this role, I also focused on automating security testing and compliance checks, helping to
shift security left in the development process. I collaborated with cross-functional teams to
ensure that security was a shared responsibility and not just the job of a separate team.
While I can't share the clients I worked with, they worked in industries that included:
- Semiconductor design, materials, manufacturing, packaging and testing
- Electronic auto parts (and associated cryptography, supply chain governance)
- Enterprise software (such as OEM) and critical interfaces
- Embedded systems (such as automotive and IoT devices)
- Military robotics (particularly at the MilBus and other interfaces)
- Highly secure facilities (such as data centers and government installations)
Projects at Chain Security
Custom Application Development
Custom IT separations often required very specific and generally unavailable toolsets. I
developed custom web applications (Django stack or ASP.net Core in C#) as needed to fill in
technical migration gaps that arise at the interface of different systems and platforms, in
particular navigating the complexities of data transfer and integration in partially or
entirely Government cloud-based environments.
Tooling
- ASP.NET Core (C#)
- Django (Python)
- Microsoft Graph API/CLI
- Microsoft 365 Admin Center (Commercial and Government Cloud)
- Windows Server and Active Directory
- Enterprise software as needed
IT Separation Plans
We had clients with complex IT environments, and I architected IT separation plans in the
hundreds of pages, complete with citations (usually
based in NIST SPs) and custom diagrams and screenshots. These plans were carefully created in
collaboration with points of contact at the client organization and often required dozens of
hours of interviews and discussions to lay out all of the organization's business requirements
for their IT stack. Tension typically arose from a foreign company acquiring the business and
entering into an LOA with the US Government requiring adherence to specific data handling and
security protocols in exchange for
access to necessary business information.
Company culture often showed up here as both friend
and foe; employees
often feel loyal to their company and coworkers to the extent that it can blind them from
potential vulnerabilities within an organization. Taking the time to get to know the companies
involved and establish a baseline of trust is critical to developing a plan that the
organization can actually use and succeed with.
- I identified missing information needed for planning and compliance documentation.
- I filled in these gaps by identifying and interviewing former and current employees, and
consulting
documentation that might be found on old servers, on the internet, on-premises, and on the
Wayback Machine, sometimes translating from other languages using my extensive background in
linguistics and translation. For instance, some critical legacy automotive tools had very
old documentation only available in German, which I was able to use to figure out
the equipment's functionality and firmware integration points.
- I participated in the implementation of these high-pressure technical and logical IT
separations
while helping clients to meet strict government standards of
confidentiality, integrity, and accessibility, acting both as technical lead and internal
auditor, tracking possible issues before they arose.
- Through interviewing client employees at many levels of the organization, I determined key
business and
technical requirements,
using their domain knowledge to familiarize myself with critical business requirements that
needed
protection throughout the migration, and communicating these requirements to management.
- I acted as flexible jack of all trades to manage all levels of IT support during technical
migrations and separations while maintaining careful and accurate documentation of the
process
Incident Response Plans
Working closely with stakeholders, I created incident response plans (IRPs) for big players in
the cybersecurity space, curated as detailed
manuals with accompanying swim lane diagrams and all actors defined. I went through the
plans with stakeholders to ensure clarity and alignment with business objectives, developing
them iteratively over the course of many meetings.
Training and Awareness
I developed and presented slide presentations to train large groups of employees on technical
and security changes to their work environment, including onboarding, hardware access
procedures, and training on any new software tools and
processes.
