Lead a global team of five product security engineers that design, implement, and maintain the tooling and automation used by Rippling Security including SAST, SCA, Secrets Scanning, and Bug Bounty capabilities to discover security risks and drive remediation across an engineering organization of over 2000 team members. Analyzed and refactored Rippling's vulnerability management process by auditing and updating SLAs, implementing self-service risk extensions, and developing a critical new security gate that gives the engineering organization better tools to prioritize fixing vulnerabilities. This resulted in a 95% decrease in out-of-SLA vulnerabilities month-over-month, an 80% reduction in long-lived vulnerabilities, while average overall vulnerabilities remediated in a month grew 1000%. Led a cross-functional project across Rippling's engineering organization including security, infrastructure, and product engineers to reduce the number of high-confidence secrets improperly stored by 95%. Developed and deployed a system of tracking code ownership across the engineering organization to automatically triage new findings surfaced from our various vulnerability discovery tools saving 40 hours of work per week.

As the first Application Security hire, I built out the application security program from the ground up to include threat modeling, architecture review, code review, static analysis, software composition analysis, dynamic analysis, and vulnerability lifecycle management functions to the organization. Led a team of two to provide application security guidance and support for a team of over 80 developers across distributed locales and timezones as we built a greenfield platform for our brands Conducted architecture and code review regularly and early during development lifecycle of new Moe’s mobile application that prevented several high and critical vulnerabilities from reaching production, saving us countless hours rearchitecting and redeveloping core services in our new app Performed threat and risk modeling and worked directly with company leadership to surface risk and track it through our risk register process to inform critical business decisions around deployments Interviewed penetration testing vendors and conducted the first ever application penetration test in company history, resulting in the remediation of several vulnerabilities before the Moe’s app launch Designed interview materials, sourced candidates, conducted interviews and coding exercise, and ultimately hired and onboarded our first junior application security engineer

Design, develop, and maintain tooling to ingest security vulnerabilities from a wide variety of sources then surface and track them throughout the software development lifecycle for all internal projects Led the development of a new service to report on static analysis scan results for over 500 repositories, resulting in a 400% increase in static analysis adoption internally Headed an initiative to design our secrets in source code remediation process that detects, assigns, and removes secrets in version control for more than 10000 repositories Own the process to promote the results and impact of our secret scanning and static analysis tooling to a cross-functional team that represents members across the organization and executive leadership Develop a suite of powerful and precise custom static analysis rules with a high degree of accuracy and minimal false positive rate using CodeQL that is used to secure the products that GitHub builds Educate fellow members of the security team on how they can leverage static analysis tooling in their existing workflows by encouraging paved paths and detecting variants of known vulnerabilities Build, maintain, and refine tools and chatops used across the Product Security Engineering organization to help reduce toil for colleagues and shift security processes earlier in the development lifecycle

Designed and implemented security measures mitigating various OWASP Top 10 vulnerabilities, such as injection, file inclusion, and remote code execution attacks Led a cross-functional effort to design a pipeline for vulnerability discovery and patch management Maintained a service and process to schedule, run, and track results from a security static analysis tool to help security reviews scale with a rapidly-expanding engineering team Conducted security architecture reviews for project teams to offer feedback and guidance on secure application and infrastructure design, highlighting security and privacy risks earlier in the software development lifecycle Prepared materials and gave presentations to educate colleagues about security best practices in software development and personal technology Managed issue triage and response during security incidents to ensure that actions taken by our team and others were secure, necessary, and prompt

Built and maintained suite of Selenium browser tests driven by Cucumber test runner Contributed to web API testing suite that tests every available internal and external endpoint Developed Appium-driven mobile UI testing suite that tests both Android and iOS applications

Operated as a bridge of communication between the support department and developers Tested quality of pre-production software and provided feedback to our software developers