Samuel Reed
San Francisco, CA
Updated : 1/29/24
Product & Application Security Professional
Professional Experience
Security Engineer (Staff level), Security Team at Pave Inc. (January 2023 - Current)
-
Joined Pave Inc. as a Security Engineer (Staff level), third security
hire on the Security team that reported into Engineering. Team
operated in a fast paced dynamic start-up environment, customer
focused and light of development process to deliver product.
-
Focused on Application Security, picking up responsibilities for a
lightweight and dynamic Application Security program. Program focused
on dynamic testing (two annual penetration tests, bug bounty program,
and DAST scanning) and static analysis (Snyk Code and Semgrep in
CI/CD). Program management and logistics for penetration testers and
hundreds of bug bounty hunters. Security Reviews, threat modeling, and
application feature security reviews on request.
-
Ran a one-off covert physical security penetration test, supporting an
external consultancy in their mission to break into the office and
steal assets undetected.
-
Managed the penetration testing engagements and bug bounty program:
reviewed issues, drove fixes, and handling external communications.
Migrated from one bug bounty program vendor to a new vendor during
this time.
-
Internal penetration testing for product features and package
releases, notably the Foundations product release.
-
Cross engineering pod interviews to develop an architecture overview
for use in security testing, onboarding new employees, and
establishing components with security priorities for further
review.
-
Vulnerability archeology to collate all historical issues, track their
details, and identify the company's own unique issues and top 10.
-
Developed recorded security training on a variety of topics: secure
design principles, timing attacks in Node.js, IDOR attacks, and
semgrep usage.
-
Developed Security Awareness Month 2023 CTF challenge, consisting of a
target server with seven pertinent challenges based on the year's
findings and backed by a CTFd administration server.
-
Partnered with coworkers to work on shared projects such as shared
security severity scales, consistent risk analysis, and supporting
customer security questionnaires.
-
Various lightweight scripts to support testing efforts, configure test
accounts for testers, support testers and bug bounty hunters, and look
for specific security issues. Semgrep rule development for specific
company issues and analysis of OSS rules for introduction into the
CI/CD pipeline.
-
Ran the Incident Response Table top, based on various company specific
issues and introduced variations on scenarios presented to test how
incident response would change and discover gaps for the
retrospective.
-
Developed the initial proposal for Content Security Policy, later
assisted with consulting and deployment of a larger minimally
permissive CSP policy to meet customer requests.
-
Established SAST baselines and code review burn down to meet SOC 2
requirements.
-
Technologies in use: GCP, Firebase, Node.js, Express, BurpSuite, Snyk
Code, semgrep.
-
Programming languages reviewed: Node/TS
-
Programming languages used: Node/TS, light Python, Semgrep rule
development
Staff Security Engineer, Cloud Security Team at MongoDB Inc. (October
2020 - November 2022)
-
Joined MongoDB as a Staff Security Engineer on the Cloud Security
team, part of the Cloud Engineering organization. Team went from a
sole lead already at the company to a three person team specializing
in application security the day of hire, and we began building out the
fundamentals of a security team from this starting point. Team was
also in charge of basic detection and response engineering for Cloud
application security monitoring, developing basic alerting and
responding to Cloud product security issues and customer concerns.
-
Strategy consulting on topics from application security program
design, incident response program design, trust & safety program
design, maturity model measurement against BSIMM and OpenSAMM, and a
wide range of other areas based on experiences at other companies.
-
Architecture/Security reviews of features and products through the
Cloud Engineering's Scope/Spec process, influencing design prior to
implementation to address security issues.
-
Static analysis code reviews to establish baselines with commercial
SAST products, and investigations into other open source alternatives
gosec, semgrep, and CodeQL for Golang. Review of static analysis rules
and informed strategy for static analysis roll outs.
-
Penetration testing of authentication systems, and the Atlas, Realm,
and Charts products. Triage of issues in our domain of responsibility
coming from responsible disclosure and bug bounty sources. Enrichment
of third party penetration test results and follow up with engineering
to get the best possible fixes in place in accordance with our lower
level knowledge of the product.
-
Designed and implemented the CSEC vulnerability tracking project to
get visibility on trends and patterns. Analyzed all available
vulnerability data back to January 2019 to establish origins, status,
time to close, and other meta-data about vulnerabilities to inform
team strategy and approach going forward. Project design based on
previous experiences at Netflix and Credit Karma. Used in-house Charts
product to quickly develop a dashboard pulling vulnerability data
cross-fed from JIRA through a mongo database. Started the engagement
model to reach out to meet with teams and follow up on status in a
regular cadence.
-
Developed the approach to FedRAMP's Continuous Monitoring (ConMon)
requirements for application security concerns, creating a process
that was repeatable and documented, providing artifacts for auditors
to achieve FedRAMP Ready status in May 2021. Project eventually grew
into development of a custom Burp Plugin to navigate custom
authentication flows and site navigation to facilitate fully automated
scanning.
-
Towards end of tenure, took on Snyk dependency scanning plugin
maintenance work and migration of automated security tools into
Kanopy, MongoDB's internal tooling deployment system.
-
Contributions to the Security Controls project, documenting secure
coding practices to eliminate security issues with respect to our own
technology stack and custom security libraries.
-
Implemented basic Splunk alerts for initial detection and response
capabilities based on experiences of a penetration tester. Exercised
attack patterns and created the capabilities to capture an attacker
performing the same testing of our product.
-
Team improvements to process around onboarding, interviewing
standards, tracking work on tickets, and more day to day security team
tasks.
-
Interviewing responsibilities to consider candidates for the team.
-
Technologies in use: AWS, MongoDB's cloud products (Atlas, Realm,
Charts), BurpSuite, Veracode, Snyk Code, mongodb.
-
Programming languages reviewed: Java and Golang.
-
Programming languages used: light Java for spot fixes and expanding
the in-house encryption libraries, Python.
Director, Security Engineering (Application Security) at Credit Karma
Inc. (January 2019 - February 2020)
-
Joined Credit Karma as the Director of Application Security. Led the
team through the launching of the Savings Account product offering,
Noddle re-brand, and the UK environment launch.
-
Hired the team up to 14 individual contributors (ICs) and 1 manager from
a team of 6 ICs. Established AppSec presence in North Carolina and UK
offices.
-
Process engineering and refinement for various team responsibilities:
tracking of vulnerabilities, onboarding, recruiting, and engineering
team accountability.
-
Established the real-time AppSec Metrics Dashboard Project to unify the
results of the team's work and raise visibility engineering
vulnerabilities. Dashboard identified teams to target for bug burn
downs, third party library vulnerability scanner integration, and
training gaps.
-
Partnered with Platform Security and Cyber (Network/Cloud) Security
teams to form the Security Design Review Group (SDRG), performing panel
based architecture reviews of new features and new microservices. Based
on office hours, the SDRG reduced meetings of potentially three or more
different one-hour meetings with teams down to a single meeting with all
representatives in attendance. Refinement further pushed one-hour
sessions to 30 minutes.
-
Mentoring and establishment of a structured on-boarding process to guide
new Application Security hires through the process of becoming
proficient in CK's architecture and technologies. Education developed in
order to develop AppSec engineers to assume the responsibilities of the
the Security Design Review Group advisors. Created new title ladders
with clear development goals to track AppSec engineer growth and
promotion targets.
-
Formulated the AppSec Engagement Model to guide AppSec engineers to
engage on a regular basis with teams, drive down vulnerability counts
through greater transparency, and inform them of new initiatives and
solutions for their specific technology stacks.
-
Started Project Insight to develop custom static analysis support
tooling to perform scanning in a scaleable manner across all code bases.
Framework supported scripts to hunt CK-specific issues and common
misconfigurations, while also running common open source security tools
like FindBugs and FindSecBugs.
-
Represented Application Security in product security investigations and
incidents.
-
Management Responsibilities: Hiring, Promotions, 9Box, 1on1s, Monthly
Functional Reviews (MFRs), Objectives and Key Results (OKRs), Risk
Register updates, procurement, and cross-organization communication.
-
Technologies in use: Microservice Architectures, Google Cloud,
TypeScript, Scala, Java, PHP, GraphQL, and Thrift.
Principal Security Consultant & Founder at Vallation Security(tm),
Inc. (December 2015 - December 2018)
-
Founded Vallation Security, Inc., a consultancy that provides
application security services such as penetration testing, code review,
architecture reviews, and application security program strategy.
-
Provided expertise in product and application security as a Principal
Security Consultant.
-
Designed secure architectures for customers to achieve specialized
purposes such as secure storage solutions in the AWS cloud.
-
Penetration testing and white paper development to provide a trusted
third party perspective on customer's products. Testing included
follow-up engagements to assess fixes and track customer investment in
product security. Produced white papers for customers of Vallation to
have a third party assessment of the customer's security posture.
-
Created specialized briefings on security topics for customers covering
modern cryptography, secure design principles, and cloud security best
practices.
-
Navigated the incorporation process to establish an S-Corporation in
California.
-
Responsibility for corporate compliance with state and federal
requirements.
-
Management of outsourced services for the purposes of accounting,
quarterly/yearly taxes, and legal matters.
-
Understanding of contemporary trademark concerns and experienced the
trademark process.
-
Developed customer relationships and customized contracting agreements
per customer needs.
-
Public speaking at OWASP Portland December 2017 on the topic of IaaS
cloud security principles.
-
Programming Languages Reviewed: Java, PHP, Golang, Ruby, and C.
- Programming Languages Used: Java, Python.
Engineering Manager, Security Intelligence & Response at Netflix, Inc.
(November 2014 - August 2015)
-
Promoted to Manager to lead the team responsible for security
intelligence, investigations, and incident response. Based approach on
the gap analysis performed while working in the previous application
security role with Netflix.
-
Security Intelligence: Initial team investments to identify current and
potential attackers using OSINT methods on the dark web. Information
collected from investigations and intelligence efforts were enriched by
various public and commercial threat feeds. Partnership in the Facebook
Threat Exchange for sharing threat intelligence.
-
Investigations: Various investigatory services for incidents and partner
teams requiring digital forensics, assistance with legal inquiries, and
security subject matter expertise.
-
Incident Response: Adopted a mixture of industry practices for incident
response (NIST 800-61) and practical solutions established by the
internal Crisis Management team. Procedures were based on an on-call
rotation, incident handlers coordinating war-rooms to guide stakeholders
through to recovery, and a post-mortem process to identify lessons
learned.
-
Standardized company run-books for major security incidents ranging from
PCI breaches to customer data exposure. Drove for transparency and
familiarity with the procedures by establishing regular cyclical table
tops with partner teams.
-
Team handled incidents ranging from compromised content producers,
vendor breaches that impacted employees, internet-scale vulnerabilities,
targeted employee phishing, and customer account takeovers (ATO).
-
Management responsibilities within the Netflix culture: heavy recruiting
focus, internal team and cross team communication via regular 1 on 1
meetings, and providing context rather than control over team
activities.
Senior Application Security Engineer at Netflix, Inc. (December 2012 -
October 2014)
-
Joined Netflix's Cloud Security team as the first dedicated application
security engineer. Responsible for devising approaches to security that
aligned with the company's "Freedom & Responsibility" culture, which
advocates individual developer freedom over process and ship gates.
Higher emphasis on developing automated solutions, monitoring, and
Security Operations over traditional SDLC oriented activities.
-
Developed tools and capabilities for developers to own the security of
their code. Examples include static analysis solutions based on FindBugs
and graudit, in addition to driving adoption of OWASP's Encoder and
Sanitizer libraries.
-
Developed training for developers: using proxies (Burp & ZAP), usage
of the OWASP libraries, and secure development practices for Node.js.
Managed the engagement between Netflix and a consultancy to provide
custom classroom training on Node.js.
-
Code reviews and penetration tests of properties involved in the core
customer experience, the digital supply chain, and other edge facing
properties.
-
Initial design and requirements of a cloud based vulnerability scanning
framework known as Monterey (Patent 20150040229), prior to its redesign
to be AWS focused. Subsequently programmed plugins for this framework,
in particular, the output handling pipeline that aggregated results into
Threadfix.
-
Refined the existing Responsible Disclosure Program and guided it
through its growth, in particular the procedures for handling reports,
communication strategies, procedures, and updates to the disclosure
policy.
-
Established the practice of tracking of both internal and external
vulnerabilities. Developed and delivered key security metrics:
vulnerability types, attack surface, vulnerability owners, mappings to
the OWASP Top Ten, remediation times, open bug counts and trends,
externally reported vulns Q/Q & Y/Y, and top reporters in the
responsible disclosure program.
-
Provided secure coding guidelines for PCI compliance and procedures for
OSS releases, including methods to prevent the accidental release of
sensitive information in Netflix's OSS releases. Implemented an
automated scan of Netflix OSS to canary on sensitive data being checked
into public repositories.
-
Analyzed base AMIs in use and recommended kernel and networking stack
hardening changes to influence all of Netflix's deployed instances and
drive towards a more secure cloud.
-
Developed "Deep Dive" brown bag presentations for internal knowledge
transfers on various topics. Organized the company-wide Sixth Annual
Security Summit.
-
Performed coordination and investigations for various high-impact
security incidents, both external (Heartbleed, GMail Breach, Shellshock)
and internal (customer and attacker investigations, public API abuse,
credential dumps, security mechanism outages). Developed the second
incarnation of Netflix's incident response documentation from its
original state to satisfy compliance regulations.
-
Performed a cross-organization incident response gap analysis to
identify what a centralized incident response team would need to cover
when established.
-
Attended Mandiant's Malware Reverse Analysis course, covering reverse
engineering malware with tools such as IDA Pro, OllyDbg, and malware
safe handling techniques.
- Programming languages reviewed: Java, Node.js, and light C.
- Programming languages used: Python.
Application Security Architect at Zynga, Inc. (July 2012 - November
2012)
-
Promoted to Architect, which involved working on larger cross-business
unit initiatives and projects while continuing to perform the duties of
a Principal Application Security Engineer.
-
Developed a new custom Security Development Life-cycle (SDL) for the
Application Security team to address the growing needs of the business
and the challenges of becoming a large platform for third party and
first party games.
-
Drove the initiative to secure the arbitrary image upload architecture
by identifying security risks and mitigations. System was based on
metadata striping/storage, PhotoDNA integration, image indexing for
later deletion, and destructive transcoding to mitigate the risks of
privacy leaks, illegal content, and malicious data.
- Received the Zynga Atlas Hero Award for Q3 2012.
Principal Application Security Engineer at Zynga, Inc. (July 2011 - July
2012)
-
Performed architecture and security reviews for the key Zynga business
initiatives: the Zynga.Com site, the underlying Zynga APIs that extend
game features to each first party and third party games, the developer
portal for developers on Zynga.Com, various aspects of mobile
authentication, payment systems, correct use of cryptography and
resilience to cryptanalytic attacks, and the underlying system behind
the GameStorage API and its fraud/cheat detection. Responsibilities
included embedding in teams, developer assistance, threat modelling, and
cross-company team interaction to insure security is designed into
Zynga's products and culture.
-
Extensive knowledge behind trends in game fraud and its overlap into
payments fraud.
-
Code review and penetration tests for various Zynga franchises on
Facebook and Mobile platforms.
- Provided expertise in both iOS security and Android security.
-
Updated application security and mobile security training decks with the
latest developments in the security industry and delivered in-person
training to remote and International offices.
-
Coded prototype Ruby applications to perform automated vulnerability
scanning of source code based on both open source vulnerability lists
and a known set of targeted "cut-and-paste"/code-forking vulnerabilities
in internally developed core libraries.
-
Programming languages reviewed: ActionScript 3.0, Java, PHP, Objective
C, and Ruby.
- Programming languages used: Ruby, light Java, and PHP fixes.
Security Consultant at iSEC Partners, Inc. (January 2010 - July 2011)
iSEC was acquired by NCC Group in 2010
-
Penetration tests for a diverse set of software products ranging from
web applications, online games, payment systems, financial transaction
systems, statistics tracking, messaging systems, online marketplaces,
content management systems, email integrations, conferencing solutions,
HR systems, financial systems, thick clients, cloud-based applications,
firewall products, virtualization products, mobile payment applications,
etc.
-
Lead role in the majority of the reviews performed, responsible for
delivering the status reports, the creation and readout of the final
deliverable, managing customer expectations, organizing penetration
tester logistics, post-engagement Q&A, and any crisis that should
arise during the engagement.
-
Performed multiple source code reviews to identify vulnerability classes
such as, but not limited to, buffer overflows, SQL injection,
access-control related vulnerabilities, and business logic flaws.
-
Architecture reviews for cutting-edge security mechanisms, secure
architecture alterations, non-traditional authentication and password
recovery workflows, web application and back end integration, etc.
Capable of identifying gradients of solutions to address existing
architecture with its own unique set of constraints in addition to
guidance on completely new systems.
-
Security reviews of payment processing systems and in-application
purchases on Facebook and Mobile devices. Reviewed libraries calling out
to payment processor APIs, middle-business software between the merchant
and processor to deliver financial services, logging and transaction
database security, verification of fraud detection capabilities and
their resilience against smurfing, credit card and refund abuse such as
non-referenced credits, purchasing race conditions, and the secure
storage of financial data on mobile devices using platform security
mechanisms.
-
Mobile application security reviews for Android, iPhone, and iPad
devices to identify security issues related to privacy, access control,
Android intents, Android activities, and iOS foibles. Experience with
both using the Android emulator in addition to remote debugging tools.
-
Programming languages reviewed: PHP, Ruby, Java, C, C++, Objective C,
ActionScript, and Bash/Shell scripts.
-
Programming languages used: light Python scripting to write simple tools
for use in penetration testing and to meet a customer request for a tool
to improve the quality of Skipfish scans.
Security Researcher at Adobe Systems, Inc. (August 2007 - January
2010)
-
Worked on the Adobe Secure Software Engineering Team (ASSET),
responsible for providing domain expertise in security and supporting
all the product teams throughout Adobe to secure their products.
-
Intimate knowledge of security best practices, secure coding, testing
methodologies, and the Secure Development Lifecycle (SDL).
-
Devised a custom SDL for Adobe based on existing processes, gaps, and
risk; developed the process flow based on priority, domain knowledge,
feature sets, and the outcome of a self-guided questionnaire for
development teams to complete.
-
Created threat models for a vast array of shipped Adobe products and
technologies, especially as the researcher responsible for Creative
Suite 4 Master Collection, by interviewing developers and reviewing
design specifications.
-
Designed and implemented a general purpose tool in Java to sign
arbitrary data which was adopted to sign product updates shipped via the
Adobe Update Manager (AUM).
-
Responsible as the sole engineer for company wide support of security
tools for static analysis, code signing, and web application penetration
testing for engineering teams.
-
Created recorded modules for company wide security training program on
the topics of cryptography, privacy and personally identifiable
information (PII), AIR security, and buffer overflow demonstrations
using Metasploit 3.0.
-
Audited web applications by performing both manual and automated
penetration tests to find web vulnerabilities such as cross-site
scripting (XSS), cross-site request forgery (CSRF), SQL injection, weak
cryptography, poor authentication, etc. Knowledge of network testing
methodologies and tools such as AppScan, Nessus, nmap, Charles, Burp
Proxy, and WebScarab.
-
Programming languages reviewed: C/C++, Java, Javascript, ActionScript
2.0 and ActionScript 3.0.
- Programming languages used: Java and Javascript.
Software Engineer at LynuxWorks, Inc. (September 2005 - June 2007)
LynuxWorks was rebranded Lynx Software Technologies in 2014
-
Hired as a software engineer and member of the security program for
hardening the in-house real time embedded operating system LynxOS-SE
before transitioning to the kernel team to achieve a Common Criteria
protection profile.
-
Performed static analysis code reviews for security vulnerabilities such
as buffer overflows, stack overflows, integer overflows, race conditions
in POSIX threads code, path traversal attacks, and format string
vulnerabilities.
-
Designed subsystems for the in house real-time embedded operating system
LynxOS-SE intended to achieve the Common Criteria EAL 4+ Certification,
adhering to the Single Level Operating System Protection Profile (SLOPP)
requirements for Security Audit, Identification and Authentication, and
TOE Access.
-
Peer reviewed subsystems designed by coworkers for adherence to
Cryptographic Support, User Data Protection, Resource Utilization, and
Trusted Path/Channels requirements.
-
Validation of Common-off-the-shelf (COTS) software products, ranging
from databases to frameworks, on an Abstract Binary Interface (ABI)
layer to support *nix applications.
-
Kernel Engineering: Ported BSD license libraries/applications to the OS.
Expanded kernel capabilities by writing device drivers and system calls.
Added security related auditing and PAM modules by pulling from open
source and making modifications as needed.
- Programming languages reviewed: C
-
Programming languages used: C, Perl, Linux shell scripting, and expect.
Education
B.S., Computer Science, Minor: Mathematics, Graduated May 2005
San Jose State University, San Jose, CA