Jun 2023 – Present · 2 yrs 9 mos · Hybrid

• Defined and executed a global product security strategy aligned with business objectives, significantly reducing critical vulnerabilities across all regional platforms.
• Established a Security Champions program across engineering teams, driving measurable reduction of critical issues identified through cloud security posture assessments and cyber asset management.
• Led security governance initiatives including regular threat landscape reporting and security posture updates to C-suite and senior leadership.
• Designed and maintained an enterprise security awareness program using a security awareness & phishing simulation platform, fostering a culture of security across the organization.
• Directed evaluation and proof-of-concept initiatives for DevSecOps tooling — SCA, SAST, DAST, zero trust network access, and container security — driving adoption of best-in-class practices in the development lifecycle.
• Spearheaded AI security initiatives — developed threat models for LLM-integrated features, established prompt injection testing frameworks, and defined security guardrails for generative AI deployments across product lines.
• Led AI security exercises to identify adversarial attack vectors in ML pipelines, including data poisoning, model evasion, and insecure model serialization risks.
• Authored internal AI security guidelines aligned with OWASP Top 10 for LLM Applications, enabling engineering teams to securely integrate AI/ML capabilities into production systems.
• Oversaw vulnerability remediation programs leveraging vulnerability scanning and endpoint detection & response (EDR) platforms, significantly improving the company's security posture.

Nov 2019 – Jun 2023 · 3 yrs 7 mos · Hybrid

• Led implementation of a secure development lifecycle, substantially improving time-to-fix and embedding security best practices from design to deployment.
• Deployed continuous monitoring and application security tooling, detecting and mitigating threats across the full application portfolio.
• Integrated SAST, DAST, and SCA into CI/CD pipelines, enabling shift-left security and reducing vulnerability detection time across engineering teams.
• Implemented WAF rules and ingested logs into SIEM, ensuring robust protection and real-time threat visibility for multiple business units.
• Conducted threat modeling sessions and secure architecture reviews, supporting product teams in building security into new features and services.
• Presented regular security metrics, vulnerability trends, and remediation progress to senior leadership.