First Citizens Bank

Reporting to the Chief Information Security Architect, duties include supporting the Systems Development Life Cycle (SDLC) as a reviewer and approver, contributing to the development of InfoSec standards, opportunistically identifying security concerns and driving them to remediation, supporting audit and regulatory activities, and helping ensure Bank solutions are reasonably secure.

Senior Information Security Architect

Falcon's View Consulting, LLC

As a solo consulting practice, providing cybersecurity professional services to multiple industries. Project work includes content development, security architecture, security product strategy and development, high-level security assessment and advisory services, specialized security training, and DevOps/DevSecOps architecture. Engagements include technical security ghost writing, program assessment based on NIST CSF, security advisory services on topics including risk management and container security, and general enterprise security architecture. My practice has been idle since mid-2019.

Principal

SmithRx

First full-time security hire for the company. Brought in to build out security program and security architecture roadmap, as well as to assist with completing critical audits and implementing various security practices. Work efforts completed include:
•	Core Security Program Design: Designed and created a roadmap for the build-out of core security program capabilities, including vulnerability management, risk management, data security, application and product security, third-party risk management, and business continuity management.
•	Critical Security-Related Processes: Designed and began implementing critical security processes through cross-team collaboration, including identity lifecycle, access management, routine security testing, vendor security reviews, cloud security monitoring, audit support, and policy revisions.
•	Security Tooling, Services, and Architecture: Identified security capability needs, designed solutions, evaluated vendors, and shepherded associated budget requests through review and approval. Solutioning included evaluating vendors for Managed Detection and Response (MDR), Cloud Security Posture Management (CSPM), application security testing, password vault/management, identity governance and administration (IGA), network remote access controls for sensitive environments, and container workload protection. Additionally, provided security architecture support to engineering teams around software designs and security-related questions.

Senior Corporate Security Engineer III

Entegral

Time was split between providing security architecture leadership, participating as an Enterprise Architect (EA) within the Engineering Board, participating in and helping evolve the Technology Adoption Process, and overall providing technical leadership for the organization. Additional EA support was also provided to the internal team responsible for user endpoints and corporate IT services.
 * Security Architecture: Led initiatives and provided guidance in several areas, including security program management, security policies and standards, security roadmap and strategy, prioritization of resolving security capability gaps, identification and implementation of security solutions, and generally representing security across the organization.
 * Engineering Board: The Engineering Board was comprised of all Entegral Enterprise Architects and provided technology oversight for the organization. Our stated mission was to “relentlessly pursue the iterative delivery of evolutionary, right-sized, secure, scalable software products.” We collaborated to facility awareness and cooperation across our respective value streams, as well as helping set standards and guide technology decisions that were aligned with strategic direction from the executive leadership team.
 * Technology Adoption Process: Participated as an EA in the review of new technology requests, as well as working collaboratively to evolve and optimize the process. The purpose of this process was to provide some high-level governance around introduction of new technologies (whether tools or services) into the organization without proper planning, consideration, or support.

Enterprise Security Architect

Equifax

Security EA assigned to cover SSDLC and container security, as well as other DevSecOps-related topics as they arise.

Security Enterprise Architect 

Performed security reviews of project designs to evaluate adherence to security technical requirements and for appropriateness of security controls and practices, including ensuring that a proper data flow diagram was in place and assisting teams with threat modeling during the project lifecycle. Assisted project teams with security solutioning when defined patterns meeting technical requirements did not exist. Participated in training delivered to technical architects and project leads on how to compose a data flow diagram and how to perform threat modeling. Completed foundational training on Google Cloud Platform.

Security Solutions Architect

Hobsons

Provided technical security leadership within the CloudOps team and across the Technology division. Day-to-day responsibilities included working with software development project teams to ensure proper cloud security measures were in place and maintained, leading tooling evaluations (e.g., log management, container and serverless security tools), leading log management platform migration (from Splunk to Devo), and leading clean- up of AWS IAM configurations (including a transition to AWS SSO). Worked in a matrixed relationship with the Security team to also provide input and propose direction on key capabilities such as security standards and operational security practices. Hobsons was dissolved in February/March 2021.

Cloud Security Architect

Hilton

Provided security architecture and strategy guidance to projects and teams on a variety of topics, including DevSecOps, application security testing, secure coding, secure application and system design, cloud and container security, and enterprise security. My day-to-day activities included reviewing or advising project designs, working within internal security resources on testing approaches, planning and developing security standards, and being a general advocate for information security across the organization.

Principal Application Security Architect

Pearson

Provided front-line management of a team of security engineers and architects responsible for identity and access management (IAM), multi-factor authentication (MFA), cloud security, container security, and data security (including encryption and certificate management). Provided technical leadership for the IAM and MFA initiative, including support for solution design and program communications.

Manager, Security Engineering and Architecture

New Context

Served in a variable role performing research, product management of in-house development projects, and conducting business development. Efforts included creation of materials around the "Lean Security" methodology, development of presentations for conferences, and writing copy for sales collateral, blog posts, and byline articles. New Context has a focus on secure DevOps services and product development.

Principal Security Scientist

Ellucian

Evaluated current security processes, tools, and practices as a member of the information security team reporting directly to the CISO. Charged with evaluating the effectiveness of current solutions and identifying gaps in security protection. Developed a comprehensive security architecture framework to evaluate and manage security architecture strategy for both traditional on-premises and cloud environments. Worked with vendors and cross-organizationally to identify, evaluate, and test (pilot) solutions. Technologies evaluated included data loss prevention (DLP), endpoint detection and response (EDR), traditional endpoint security, email security solutions (on-premises and Office 365), enterprise mobility management (EMM), network security tools and capabilities, identity and access management tools and capabilities, application security practices, cloud security tools (such as for AWS) and container (Docker) security tools. Technologies in-scope included AWS, Okta, Digital Guardian, IBM BigFix, Symantec EPP, Zscaler, Microsoft Adallom, FireEye, Splunk, Ansible, Rapid7, Tenable, CloudCheckr, StackRox, Jump Cloud, among many others.

Manager, Information Security Architecture

Ben Tomhave is a security industry veteran, progressive thinker, and culture warrior. He holds a MS in Engineering Management from The George Washington University, a BA in Computer Science from Luther College, is a CISSP, and is a graduate of the BJ Fogg Behavior Design Boot Camp. He's previously held positions with Hilton, Gartner, AOL, Wells Fargo, ICSA Labs, LockPath, and E&Y. He is former co-chair of the American Bar Association Information Security Committee, a senior member of ISSA, former board member for the Society of Information Risk Analysts, and former board member for OWASP NoVA. He is a published author and experienced public speaker, including engagements with the RSA Conference, MISTI, ISSA, RMISC, Secure360, RVAsec, DevOps Connect, as well as Gartner events.

Taplio

Ben Tomhave's Linkedin Analytics

Want to drive more opportunities from LinkedIn?

Taplio

.css-1jgreyo{background-image:linear-gradient(284deg, rgba(39,43,72,1) 0%, rgba(33,47,183,1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Ben Tomhave's Linkedin Analytics

Want to drive more opportunities from LinkedIn?

Ben Tomhave's Linkedin Analytics