May 2020 – May 2025 · 5 yrs · Oakland, California, United States · Hybrid

• Built and scaled LaunchDarkly’s security organization, driving security, compliance, and developer velocity through innovative programs and automation.
• Product Security
• Developed a security asset data lake for querying and visualizing asset data with correlated security annotations.
• Automated FedRAMP vulnerability management, streamlining continuous monitoring.
• Migrated to a zero-trust endpoint architecture and reduced production data access via tiered controls and a GitHub Actions-based data access platform.
• Infrastructure Security
• Deployed phishing-proof MFA and device trust policies with Kolide for compliance checks.
• Automated least privilege RBAC in Okta via Terraform and HRIS integration.
• Delivered custom security training and enhanced detection/response with red team exercises and recovery runbooks.
• Governance, Risk, and Compliance (GRC)
• Achieved FedRAMP Moderate Authorization; maintained SOC 2/ISO 27001 certifications with minimal overhead.
• Built a privacy program aligned with GDPR, CCPA, and HIPAA.
• Launched customer assurance programs, including vendor reviews, contract support, and a public trust center.

Nov 2015 – May 2020 · 4 yrs 6 mos · San Francisco

• Built and scaled Clever’s security program, delivering secure, resilient cloud-based SaaS with industry-leading security architectures and AWS expertise.
• Established and grew Clever’s first security team, building a comprehensive security program from the ground up.
• Led the migration of Clever SSO (>10 million MAUs) from a single AWS region to a multi-region architecture, significantly enhancing resiliency and availability.
• Designed and implemented secure-by-default practices, ensuring innovative features like Clever Badges met stringent security standards for protecting K-12 student data.
• Delivered a secure, scalable infrastructure to support high-uptime products, leveraging advanced AWS solutions and cloud architecture best practices.
• Pioneered innovative security measures to protect user data, aligning with compliance requirements and maintaining trust with educational partners.

Jul 2011 – Oct 2015 · 4 yrs 3 mos · San Francisco Bay Area

• Led the Account Security team to build and launch features like 2FA and suspicious login detection, enhancing user protection for millions of accounts.
• Migrated the authentication stack from the "monorail" to a Scala-based microservice architecture, improving scalability, performance, and reliability.
• Developed and implemented application security measures to prevent XSS and CSRF vulnerabilities, ensuring safer user interactions across the platform.
• Established a robust security review process to integrate secure coding practices into development workflows, reducing vulnerabilities at scale.

Feb 2006 – Aug 2009 · 3 yrs 6 mos

• Delivered software security services including penetration testing, code review, and training.

Jun 2004 – Jan 2006 · 1 yr 7 mos

• Lead developer for software security products.

Jan 2004 – Jun 2004 · 5 mos

• Designed and implemented prototype help-desk ticket application in PHP/MySQL.