aaron bryson
Director of Information Security at Blue Lava, Inc.
possession infinity stone security gem 💎
alpha omega , simultaneously architect breaker thing . 17 year experience information security cybersecurity field startup large corporate environment primarily focus software security . excellent interpersonal team-building skill . technical skill experience across multiple industry vertical including , limited : finance , marketing , sale , , manufacturing , engineering , industrial control system . exceptional analytical problem-solving skill along ability communicate level business engineer c-level executive . experienced highly skilled security engineer strongest background information security risk management . reinforced in-depth knowledge many aspect , sdlc , security , integrate business . proven ability create cost-effective manageable security solution align business process goal . thing day day : • perform superhuman feat • maintain corporate security • protect intellectual property • limit corporate liability • safeguard corporate brand • ensure compliance • give confidence customer , stakeholder , employee , partner , government • find vulnerability others specialty : data acquisition , penetration test , vulnerability assessment , risk management , threat modeling , network security , social engineering , corporate security management , security policy development , program management , business development , contract negotiation , industrial control system , incident readiness & response , disaster recovery & business continuity planning , escalation procedure , governance privacy review ( i.e. , glba , hipaa , sox , pci , etc . ) , information security management ( i.e . iso 27001 , cobit , ism3 , ci benchmark , etc . )
Blue Lava, Inc.
https://www.linkedin.com/company/blue-lava
United States
https://media-exp1.licdn.com/dms/image/C4E0BAQHxzbD5DhPxOw/company-logo_100_100/0/1600699456646?e=1655942400&v=beta&t=GwdE8dDtRQaBGom0v1S2dVjNwo_3wtc3OBLOg_cGBoU
Director of Information Security
BlackBerry
https://www.linkedin.com/company/blackberry
Focused on securing infrastructure, data, and code within cloud environments in Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP) for numerous clients.

Responsibilities included:
Network Security
Logging and Monitoring
Identity and Access Control
Data Protection
Vulnerability Management
Inventory and Asset Management
Secure Configuration
Malware Defense
Incident Response
Identity and Access Management
Compliance
Storage Storage
Database Services
Logging and Monitoring
Networking
Virtual Machines
Internet-of-Things (IoT)
https://media-exp1.licdn.com/dms/image/C560BAQEHnvbvfKCsDg/company-logo_100_100/0/1589567588312?e=1655942400&v=beta&t=5fGqWIbjE2I-OAbJznJhXgxeGI7McAMkoMffbcXfwy0
Technical Director - Red Team
Cylance, Inc.
https://www.linkedin.com/company/cylanceinc
An initial key hire for building the security consulting practice; made Cylance's first $1. I consulted directly for Cylance and BlackBerry's clients from every industry vertical around the world, including many Fortune 500s. Responsibilities included all things security, privacy, compliance, risk, and product engineering. 

Cylance® is one of the fastest-growing companies in the history of cybersecurity. Cylance is revolutionizing cybersecurity with products and services with machine learning and artificial intelligence. Our technology is deployed on millions of endpoints and protects thousands of enterprise clients worldwide including Fortune 100 organizations and government institutions.

Cylance® uses artificial intelligence to deliver prevention-first, predictive security products and specialized security services that change how organizations approach endpoint security. Cylance’s security solutions provide full spectrum predictive threat prevention and visibility across the enterprise, combatting threats such as malware, ransomware, fileless malware, malicious scripts, weaponized docs, and other attack vectors. With AI based malware prevention, application and script control, memory protection, device policy enforcement, root cause analysis, threat hunting, automated threat detection and response, coupled with expert security services, Cylance can protect endpoints without increasing staff workload or costs.

I am an Omni-hat (i.e. I wear many hats with different feathers). I am humbled each and every day by the people at this company who all possess immense talent, intelligence, passion, and compassion.  I have mastered multi-tasking and laser-focus, learned countless skills, obtained enlightened wisdom, experienced mind-altering challenges, and achieved that which was thought to be impossible. 

I love it! 🙂
Orange County, California Area
https://media-exp1.licdn.com/dms/image/C560BAQGpNc49hcfcAw/company-logo_100_100/0/1599248718656?e=1655942400&v=beta&t=c1IEUP2q-SKCvW0Zc8QsN6jksVTLkh5tt_AsTeEpk8Q
Director - Red Team (Application, Mobile, Cloud, IoT security, etc.)
Kony, Inc.
https://www.linkedin.com/company/kony-inc
Function/Responsibilities:
► Help to drive the enterprise architecture vision, service & application designs, security protocol designs and engineering to deliver the most secure Mobile Application Development Platform (MADP) and Mobile Backend-as-a-Service (MBaaS) in the market.
► Closely collaborate with the stakeholders, architects, and engineering teams and drive key security design choices made in the implementation of the product. 
► Identify and anticipate security solution requirements based on tactics, techniques, and procedures of adversaries. Conceptualize and evolve enterprise security architectures for Kony’s solutions.
► Lead and drive the security technology & architectural aspects of the product roadmap to enable building usable and secure solutions. We created a more secure, efficient, transparent, customer-friendly MADP.
► Worked with product management and engineering to achieve industry leadership recognition by Gartner Magic Quadrant for Mobile Application Development Platforms & Forrester in the Forrester Wave: Mobile Low-Code Development Platforms.
► Coordinate with Infosec and Governance, Risk, and Compliance (GRC) teams in the alignment of industry security standards, compliance requirements and certifications (GDPR, ISO, HIPAA, PCI, SOC2, and STIG/SRG).
► Evaluate new technologies to enable the business. Assist in building, managing and enhancing best practices and security tool integrations into the DevOpsSec workflow.
► Provide consultation, guidance, and training to DevOpsSec, sales engineering, partners, and customers to improve thinking, practices, and outcomes.
► Identify, collaborate and oversee security issue identification, mitigation, resolution, and elimination in various stages of product development to ensure systemic issues are resolved.
► Key contributor and mobile security evangelist; public speaking, writing blogs and whitepapers, and knowledge sharing with clients and partners on an international scale.
Austin, Texas Area
https://media-exp1.licdn.com/dms/image/C560BAQFFhOOmv2zyHw/company-logo_100_100/0/1569516035096?e=1655942400&v=beta&t=0bpn2GKihprJ5rxOfriqCKtghFDSlul8mga3frJDWw4
Acting CISO & Chief Security Architect
Veracode
https://www.linkedin.com/company/veracode
Veracode Manual Penetration Testing (MPT) complements their automated scanning technologies with best-in-class penetration testing services to find business logic and other complex vulnerabilities in the web, mobile, desktop, back-end and IoT applications.

Using a proven process to ensure high customer satisfaction, Veracode MPT provides detailed results, including attack simulations, through the Veracode Application Security Platform, where both manual and automated testing results are assessed against the client corporate policy. 

Regulations including PCI DSS, HIPAA, GLBA, FISMA and NERC CIP require penetration testing, and security frameworks such as OWASP Top 10 and SANS Top 25 require penetration tests.

Veracode uses standardized testing processes that ensure consistency while enabling consultants to apply their individual expertise. Veracode MPT focuses on identifying issues that require a manual tester’s insight and delivers results that are easily consumed by both development teams and auditors, including attack simulations showing how an attacker would exploit a vulnerability.

Responsibilities/Functions:
► Helped many companies run their application security programs. 
► Responsible for research of vulnerabilities in software, firmware and devices, and modern exploits and exploitation techniques. Developing proof-of-concept attacks, analysis of emerging threats and research of effective mitigation and security technologies. Development of security testing tools as well as presenting research results at conferences.
► Responsibilities included threat assessment, vulnerability assessment, penetration testing, architecture and design security reviews and design of security components to ensure the security of products, technologies, and systems. Partially responsible for development and delivery of security training and classes.
► Maintain continuous and substantial knowledge of state-of-the-art security principles, theories, attacks.
Burlington, MA Area
https://media-exp1.licdn.com/dms/image/C4D0BAQHp3SSrVppKrQ/company-logo_100_100/0/1642626942559?e=1655942400&v=beta&t=Q45Usfuyf3O60AanhvZGS19yXT2abxJZSvHPD1jNMVE
Senior Application Security Consultant
Foundstone (a Division of McAfee)
https://www.linkedin.com/company/mcafee
Provided subject matter expertise and act as a trusted advisor on cybersecurity. Using our Enterprise consultative mindset and approach, we partnered with our clients to design solution architecture and evangelize underlying information security principles. 

Responsibilities/Functions:
► Contributed to the security community through publication of high-quality articles or public presentation of research or innovative concepts at industry conferences or interest groups. 
► Taught Foundstone Ultimate Hacking series of hands-on classes to organizations in both the private and public sector
► Supported the sales team with the identification and development of professional services opportunities for McAfee and business partners. Understanding enterprise security strategy and where it fits within an organization enabled us to meet the client business goals and requirements. Understanding market issues and trends affecting business and use of IT/OT within various sectors
► Maintained and expand client contact at high levels and build credible relationships with key client personnel. Managed complex multi-faceted security testing assignments. Program and project managed geographically distributed projects
► Managed the development and quality assurance of security test deliverables, development of appropriate remediation plans, and translated technical information into business risk for non-technical contacts
► Performed a variety of security testing assignments, including red teaming, infrastructure and application assessments. Mastered target service line methodologies, and lead teams in engagements in the following:
☛Strategic Security - Assess and develop risk management programs via Risk Assessment, Policy Analysis and Assessment, SDLC
☛Infrastructure Security - Internal/External Penetration testing and assessment, Web Application Penetration Testing, Security Architecture
☛Application Security - Threat modeling, Source Code Review, provide guidance on secure SDLC
Dallas/Fort Worth Area
https://media-exp1.licdn.com/dms/image/C560BAQEKJd5GJvVCug/company-logo_100_100/0/1646934717287?e=1655942400&v=beta&t=p0ViRsb5cCEZwjp741X0JcdX2cKexzbIM_MlWPzKz8U
Senior Consultant with McAfee Strategic Security Solutions
Gosu Security
Gosu Security is an experienced security consulting firm providing cyber, information, and application security services to clients in many industries. Our seamless integration of functional expertise and deep industry knowledge is the key to our client services. We provide the following services:

► Virtual CISO (vCISO) services
► Web/Mobile/IoT/Application Penetration Testing
► Secure Software Development Life Cycle (SDLC) Strategy and Implementation
► Static Application Security Testing (SAST)
► Dynamic Application Security Testing (DAST)
► Threat Modeling
► Architecture solution design and review
► Policy/standard/guideline creation and review
► Critical Controls and Best Practices Review
► Amazon AWS and Microsoft Azure Security Assessments

Industries we regularly provide services to:
► Independent Software Vendors
► Automotive
► Financial Services/Tech
► Healthcare Systems/Services
► High Tech
► Media & Entertainment
► Pharmaceutical & Medical Products
► Retail/E-Commerce
► Telecommunications
► Travel, Transport, & Logistics

We work with organizations across the private and public sectors. We have deep functional and industry expertise that allows us to provide meaningful security services. We are passionate about taking on immense challenges that matter to our clients.

By building your capabilities and skills at every level and every opportunity, we help build internal support, identify real issues, and reach practical recommendations. We bring out the capabilities of clients to fully participate in the process and lead the ongoing work.

Our consultants have integrity, sharp analytical minds, leadership potential, creativity, and the ability to work with people at all levels in an organization. We value support, caring, trust, and respect.
Austin, TX
Founder
CISCO / INFOSEC SERVICE OPERATIONS (ISO) - AUSTIN, TX
https://www.linkedin.com/company/cisco
► Protect company assets and ensure business continuity
► Fraud and risk management
► Work with architects and DevOpsSec to build the corporate application security program and develop secure software development lifecycle (SDLC) practices
► Provide black-box and white-box web application/web service penetration testing services to large enterprise customers, partners, acquisitions, and Cisco.
► Responsible for finalization and delivery of information to technical management and senior (C-level) executives
► Develop and maintain methodologies and software tools to enhance Cisco penetration testing services.
► Contribute directly to Cisco's knowledge management initiatives by documenting and briefing other Cisco DevOpsSec on lessons learned from engagements.
► PCI/PCI-DSS, SAS70/SSAE16/SOC, ISO auditing and compliance
https://media-exp1.licdn.com/dms/image/C560BAQHIcy_n-VigJA/company-logo_100_100/0/1647476063807?e=1655942400&v=beta&t=XBRKXolKBnVbaHVj4I1ylOhqQxKgJu-aH2gxiVG8DPo
Senior Information Security Engineer / Senior Risk Management Specialist
CISCO / INFOSEC SERVICE OPERATIONS (ISO) - AUSTIN, TX
https://www.linkedin.com/company/cisco
► Deliver application penetration testing, wireless penetration testing, and other security services to Fortune 100 customers
► Made the impossible possible with a team of amazing and talented engineers
https://media-exp1.licdn.com/dms/image/C560BAQHIcy_n-VigJA/company-logo_100_100/0/1647476063807?e=1655942400&v=beta&t=XBRKXolKBnVbaHVj4I1ylOhqQxKgJu-aH2gxiVG8DPo
Network Consulting Engineer & Application Security Engineer
CISCO / INFOSEC SERVICE OPERATIONS (ISO) - AUSTIN, TX
https://www.linkedin.com/company/cisco
► Enhance security team accomplishments and competence by planning the delivery of solutions; answering technical and procedural questions for less experienced team members; teaching improved processes; mentoring team members.
► Determine security requirements by evaluating business strategies and requirements; research information security standards; conduct system security and vulnerability analyses and risk assessments; studying architecture/platform; identify integration issues; prepare cost estimates.
► Implement security systems by specifying intrusion detection methodologies and equipment; directing equipment and software installation and calibration; prepare preventive and reactive measures; create, transmit, and maintain keys; provide technical support; completing documentation.
► Verify security systems by developing and implementing test scripts.
► Maintain security by monitoring and ensuring compliance with standards, policies, and procedures; conducting incident response analyses; developing and conducting training programs.
► Upgrade security systems by monitoring security environment; identify security gaps; evaluate and implement enhancements.
► Prepare system security reports by collecting, analyzing, and summarizing data and trends.
Austin, Texas Area
https://media-exp1.licdn.com/dms/image/C560BAQHIcy_n-VigJA/company-logo_100_100/0/1647476063807?e=1655942400&v=beta&t=XBRKXolKBnVbaHVj4I1ylOhqQxKgJu-aH2gxiVG8DPo
Software Engineer
Naval Air Systems Command (NAVAIR)
https://www.linkedin.com/company/naval-air-systems-command
NAVAL AIR WARFARE CENTER - WEAPONS DIVISION (NAWCWD)
CENTER FOR ASYMMETRIC WARFARE (CAW)

The Center of Asymmetric Warfare (CAW) provides testing, training, and experimentation support for Department of Defense expeditionary forces to prepare them to counter the effects of asymmetric warfare. We exercise large-scale "multi-agency, multi-level" events dedicated to supporting Homeland Security and supporting US and allied military forces to conduct Homeland Defense by recognizing, countering, and controlling the effects of terrorism, weapons of mass destruction, and information warfare.

Asymmetric Warfare Initiative (AWI) is a major-centered homeland security exercise that will exercise military, local, state, and federal authorities in a maritime/coastal terrorism context.

Served as a technical administrator, adviser, and support for the Joint Information Operations Center (JIOC) during the AWI-04S exercise composed of the Federal Bureau of Investigation, US Coast Guard, Joint Terrorism Task Force, Department of Energy, Naval Air Warfare Center Weapons Division, Governor’s Office of Emergency Services, and Anti-Terrorism Intelligence Center, with a total of 60 agencies participating. Work includes planning, tabletop, and live exercises.
Pt. Mugu / China Lake
https://media-exp1.licdn.com/dms/image/C560BAQEFYJg7y1weLA/company-logo_100_100/0/1549910666042?e=1655942400&v=beta&t=cR8CcXp88vmk6yRfFTvCBH80h9_89ZJKiIKw4HUK2X0
Joint Information Operations Center Administrator (contractor)
8 App Security Issues
Kony, Inc.
https://www.kony.com/resources/blog/8-app-security-issues
4 Reasons Why Enterprises Fail at Mobile Security
Kony, Inc.
https://www.kony.com/resources/blog/4-reasons-why-enterprises-fail-mobile-security
What Citizen Developers Should Know About Mobile Security
eSecurity Planet
https://www.esecurityplanet.com/mobile-security/citizen-developers-mobile-security.html
5 common mobile security vulnerabilities
RCR Wireless News
https://www.rcrwireless.com/20160627/opinion/reader-forum-5-common-mobile-security-vulnerabilities-tag10
State of IoT Security - Q&A
Kony, Inc.
https://www.kony.com/resources/blog/state-iot-security-qa
How (and why) to start a bug bounty program
Computer World HK
https://www.cw.com.hk/security/how-and-why-to-start-a-bug-bounty-program
Bug bounty programs are a cost-efficient way to fortify your systems. Here’s how GitHub launched theirs, plus tips to get started.
How (and why) to start a bug bounty program
ITworld.com
http://www.itworld.com/article/2988898/security/how-and-why-to-start-a-bug-bounty-program.html
From hacking smart cars and mobile apps to phishing employees at companies around the world, Aaron Bryson has done it all… but for the good guys. As an ethical hacker, he uses his skills to help IT fight against malicious hackers that pose a threat to corporate networks, endpoint devices, applications, cloud services, and data. In this presentation, he’ll discuss how hackers operate, share tools of the hacking trade, and talk about the most common security mistakes that companies make. He’ll also cover commonly exploited vulnerabilities and attack vectors and he’ll share technology and policy tips on how to better protect your data from the latest threats.
I'm an Ethical Hacker: Techniques I Use to Compromise Your Data
SpiceWorld 2015
http://www.spiceworks.com/spiceworld/austin/2015/agenda/
With more people upgrading their homes to smart electronics, experts warn there's the possibility thieves could access your personal information through your phone.

Whether built-in as part of the home security system or purchased at any electronics store, the new wave of automation is boosting simple homes into high-tech abodes...
Protecting Your Home From 'Smart' Home Hackers
keyetv.com & news4sanantonio.com
http://keyetv.com/archive/protecting-your-home-from-smart-home-hackers
We recently had a chat with ethical hacker Aaron Bryson about the state of cybersecurity, common misconceptions people (even techies) have about hacking, free things IT pros should be doing to protect their networks, creative resume writing, and more. Got questions of your own for an ethical hacker? Ask Aaron in the comments below!
I'm an ethical hacker: Misconceptions about hacking and what IT pros should know
SpiceWorld.com
https://community.spiceworks.com/topic/811671-i-m-an-ethical-hacker-misconceptions-about-hacking-and-what-it-pros-should-know?page=1
A best-practice security guide to planning your mobile policy and mobile device configurations. This presentation will give an overview of mobile device security architecture, security features and capabilities, provide suggested policy recommendations and device profile settings to suit your needs. In addition, you will be provided with a security checklist for policy and mobile configurations that you can use in your own organization for planning or comparison against these recommendations.
iOS Mobile Policy and Configuration Best Practices and Recommendations
Brighttalk.com
https://www.brighttalk.com/webcast/288/63815
Presented on lessons learned from securing cloud environments to attendees at SecCon 2011 in San Jose, CA.
Cloud Security: What You Need to Know
Cisco.com
http://blogs.cisco.com/security/seccon-2011-%E2%80%93-addressing-customer-security-requirements
Penetration Testing in the Cloud
Cisco Systems, Inc.
https://blogs.cisco.com/security/penetration-testing-in-the-cloud
What you need to know about cloud penetration testing: types of testing, limitations, logistics, SLAs, and more...
Great Pen Test Coverage: Too Close For Missiles, Switching to Bullets
Pentest Magazine (Volume #1, Issue #4)
https://pentestmag.com/
Hackers are trying to break into your website 24/7.

In the last few weeks, Internet hacking attacks have increased and thousands of sites have already been compromised. Many security observers have seen 1,000,000s of scans of their WordPress installation on a single day in April, as noted by...
WordPress Under Attack
Cylance.com
http://blog.cylance.com/blog/bid/297058/WordPress-Under-Attack
Microsoft
www.credly.com
992229630
Microsoft Certified: Azure Fundamentals
https://www.credly.com/badges/ba4e056c-3d31-413e-ab17-b17bf8f506a6?source=linked_in_profile
Cigital, Inc (A Part of Synopsys)
Building Security in Maturity Model (BSIMM) for Vendors
(ISC)²
111920
Certified Information Systems Security Professional (CISSP)
Amazon Web Services (AWS)
www.credly.com
GYCXQYEJHM4114W5
AWS Certified Security – Specialty
https://www.credly.com/badges/4efbcb3a-5436-4053-b86a-1ef0be427ce1?source=linked_in_profile
EC-Council
Certified Ethical Hacker (CEH)
EC-Council
EC-Council Certified Security Analyst (ECSA)
Robert Fink, CISSP, GCIH, GSEC
      
          



            
              
        
              
  

    
        It has been my pleasure to work alongside of Aaron for the last two years at BlackBerry|Cylance. In his Cybersecurity consulting role, Aaron was always a trusted advisor to the clients we worked with. Aaron’s skills with Cloud, Application, and Website penetration testing are impressive. Our clients not only appreciated his technical skills, but also the way he tactfully presented information to senior leaders about opportunities for improvement within their environments. From a sales enablement perspective, many of Aaron’s clients returned for repeat business because of the exceptional outcomes of his projects. I’m looking forward to having another opportunity to partner again with Aaron in the future. LinkedIn User
      
          



            
              
        
              
  

    
        Aaron is a very knowledgeable and professional pen tester.  His methods are surgical, enabling him to identify critical vulnerabilities within sensitive applications.  During his tenure, he assessed hundreds of complex applications for Cisco, Partners & 3rd Parties.  Aaron was a critical asset for Cisco's Deep Application Vulnerability Assessment (DAVA) program and is a pleasure to work with.  Any organization with him on their staff definitely has an advantage among their competitors.
Liked by Aaron Bryson
https://www.linkedin.com/signup/cold-join
CrowdStrike delivered a milestone quarter combining record net new ARR of $217 million, with growth accelerating for the second consecutive quarter…
Liked by Aaron Bryson
https://www.linkedin.com/signup/cold-join
I am beyond excited to announce the launch of FIERCE -- Females In Every Role Change Everything. Rebecca Cahak and I founded FIERCE to celebrate and…
Liked by Aaron Bryson
https://www.linkedin.com/signup/cold-join
Anyone in the cybersecurity community looking to make a difference in a BIG way!? Have you thought of engaging with Congress?My path to advising…
https://www.linkedin.com/in/aaron-bryson
Greater Indianapolis
Aaron Bryson
Agent at New York Life Insurance Company
https://uk.linkedin.com/in/aaron-bryson-38a6b5149
United Kingdom
Aaron Bryson
Market research and consultancy.
https://www.linkedin.com/in/aaron-bryson-7946b666
La Belle, FL
Aaron Bryson
President
Bryson Farms LLC
https://www.linkedin.com/in/aaronbryson
Greenville, SC
Aaron Bryson
CEO at iStore |  Apple Premier Partner