Position: CISO/Program/Delivery Manager
Category: Security
English level: fluent
Years of experience: 11

•	Creating and Managing the Application Security Program from scratch and implemented throughout the enterprise;
•	Formulating and implementing monitoring, policies, procedures and standards relating to application security;
•	In-House Fortify SSC and WebInspect Enterprise Infrastructure deployment for POC and PRODUCTION environments;
•	Integrating Fortify SSC (SAST) and Fortify WebInspect Enterprise (DAST) into CI/CD pipeline;
•	Operationalizing the SAST and DAST tooling – performing SAST and DAST assessments on the regular basis;
•	Performing Vulnerability Validation / False Positive Analysis on automated tools findings and working with developers to remediate them;
•	Documenting the Secure Coding Guidelines and Misuse Cases / Checklist for Manual Penetration Testing;
•	Cloud infrastructure (Azure, AWS) security – conducting the cloud infrastructure security assessments on the basis;
•	Implementing SOC 2 Type II requirements and obtaining the SOC 2 Type I and II audit certificate for the organization;
•	Implementation of the Non-Financial Risk Management Framework & Information Security Management System (ISMS) in accordance to ISO 27000:2017 and ISO 31000 Standards;
•	Company Certification according to ISO 27001:2017;
•	The implementation the Crisis & Business Continuity Management Framework according to ISO 22301 Standard;
•	The implementation of Personal Data protection processes in line with GDPR, Privacy Shield and CCPA regulation;
•	Kubernetes cluster core security concept initial defining and implementation;
Highly experienced Cyber Security and Information/Operation Risk Management professional with a proven track record in the cloud and application security, IRM/ORM practice, including operations, consulting, incident handling, and auditing. I have strong technical and practical background, a good understanding of business, technical, physical, and human issues as well. Good at writing and presenting Cyber Security, IRM/ORM, IT Audit challenges to broaden audiences with knowledge, humor, and involvement. 

Proficient in Web Application Vulnerability Assessment and Penetration Testing, Static Code Review, Software Composition Analysis. Proficient in deployment and maintenance of Microfocus Fortify and WebInspect Enterprise components. Responsible for conducting and reviewing DAST/SAST scans on Web and thick Client applications.

As an example, The following services were delivered to the one of the Customers:

•	Cloud Security (Azure, AWS)
•	Applications Security (SAST/DAST and internal penetration testing).
•	Application Security Risk Management.
•	Microfocus Fortify Infrastructure deployment from the scratch and maintenance.
•	SOC2 Type I, II Audit, Compliance. 
•	DevOps/DevSecOps Services.