Careful Security

Project:  Cybersecurity Overhaul for a Manufacturing firm
•Risk Management: Directed a strategic cybersecurity overhaul for a 1,000-employee manufacturing firm post-ransomware attack, aligning with industry-standard frameworks.
•Security Enhancements: Implemented critical security controls, including vulnerability and patch management, security alert reviews, and log consolidation, reducing system vulnerabilities.
•Continuous Monitoring: Established security monitoring protocols, strengthening the firm's defensive posture against future cyber threats.
•Compliance Readiness: Prepared for an ISO 27001 Audit, ensuring cross-departmental adherence to top-tier security standards.
•Impact: Efforts were acknowledged by the board and positioned Careful Security as a champion of corporate cybersecurity resilience.

Cybersecurity Monitoring for AWS-Hosted Property Management Firm
•Cloud Security: Orchestrated a comprehensive security upgrade for the firm's AWS environment, eliminating critical vulnerabilities and fortifying against persistent cyber threats.
•Penetration Testing: Conducted in-depth penetration testing across web and mobile platforms, significantly enhancing the firm's cyber defense mechanisms.
•Onboarded SIEM Solution: Successfully onboarded the firm onto our advanced SIEM Monitoring solution, delivering cost-effective, continuous security oversight.
•SOC2 Type 2 Compliance: Guided the firm through the stringent SOC2 Type 2 compliance process, 
Impact: Achieved a substantial reduction in cybersecurity risk, empowering the client to attract new customers with verified cybersecurity measures.

CISO

Per Scholas

Teach Cybersecurity concepts and hands-on lab exercises to help aspiring students graduate as qualified cybersecurity professionals. Topics Covered included NIST Framework, Windows and Linux Security, Overall Infrastructure Security, Container Security, Cloud Security, Application Security, Vulnerability Management, and Penetration Testing.

Cyber Security Instructor

Warner Bros. Entertainment

Responsibilities: Leadership in Cybersecurity Operations

Spearheaded Security Operations Center (SOC) establishment and operations: Led the design, implementation, and oversight of a comprehensive SOC, ensuring continuous visibility into security posture and prompt response to threats.

Championed Risk Management Program: Established and led a robust risk management program, including proactive threat identification, vulnerability assessment, and mitigation strategies, significantly reducing the attack surface.

Guided Compliance Navigation: Successfully guided a leading media organization through PCI compliance, leveraging meticulous gap analysis, phased implementation, and ongoing monitoring, safeguarding sensitive cardholder data.

Accomplishments:
Enhanced Threat Detection: Filled critical logging gaps, enabling rapid security alert verification and reduced investigation times.

Streamlined Incident Response: Optimized log collection and consolidation processes, leading to a decrease in incident response time

Improved Security Processes: Achieved faster resolution times and enhanced system integrity by establishing processes around proactive risk management and compliance initiatives.
 
Skills: 

Security Operations Center Management, Risk Management and Mitigation, Compliance Leadership (PCI DSS and others), Log Management and Analysis, Incident Response, Security Information and Event Management (SIEM), Threat Intelligence and Detection

Information Security Architect

Electronic Arts

Technical Leadership in Cybersecurity at EA Sports:

Led proactive threat identification and mitigation: Spearheaded comprehensive penetration testing initiatives for forgotten online games, uncovering critical vulnerabilities and preventing potential breaches. This proactive approach significantly reduced EA Sports' attack surface and protected internal assets.

Championed centralized security architecture: Developed and implemented a centralized security architecture framework to standardize identity and resource management across all EA Sports studios. This initiative eliminated siloed security practices and streamlined maintenance efforts, boosting overall security posture.

Guided secure software development lifecycle (SDLC): Advocated for and implemented a standardized, secure SDLC process for game development. This included conducting threat modeling, static code analysis, and penetration testing before deployment, leading to the early identification and remediation of security vulnerabilities.

Accomplishment:

Reduced external attack surface by: Through proactive penetration testing and meticulous vulnerability remediation, significantly minimized the potential entry points for attackers.

Enhanced security and maintainability: Centralized security architecture fostered improved security across studios and simplified maintenance, increasing resource efficiency and reducing costs.

Elevated security maturity: Standardized SDLC practices led to earlier detection and resolution of security issues, improving overall security posture and ensuring the safe launch of games.

Key Skills:
    Penetration Testing and Vulnerability Assessment
    Security Architecture Design and Implementation
    Secure SDLC Implementation
    Threat Modeling and Risk Management
    Identity and Access Management (IAM)
    Security Operations Center (SOC) Management

Information Security Engineer

State Farm Insurance

Championed Secure Development Lifecycle (SDLC) and Authentication/Authorization: 

Led the implementation of robust security practices throughout the software development lifecycle, ensuring applications were built with security in mind from conception to deployment. This included secure coding practices, vulnerability assessments, penetration testing, and granular access control mechanisms.

Spearheaded Innovative Insurance Application: 
Developed a secure channel for exchanging anonymized driving data with B2B partners, enabling a personalized insurance program that rewarded safe drivers. This project involved integrating multiple systems while adhering to strict data privacy regulations, ultimately leading to increased user adoption and improved risk assessment for the company.

Built and Maintained HIPAA-Compliant Environment: 

Designed and implemented a secure environment for processing and storing sensitive health insurance data in compliance with HIPAA regulations. This involved implementing granular access controls, encryption, and continuous security monitoring to ensure data integrity and prevent unauthorized access.

Accomplishments:

Enhanced Application Security: Reduced vulnerabilities and improved overall security posture through proactive security practices throughout the SDLC.
 
Increased User Adoption: Successfully launched a novel insurance program leveraging secure data exchange, leading to significant user engagement and business value.
 
Ensured HIPAA Compliance: Built and maintained a secure environment for handling sensitive health data, minimizing the risk of non-compliance and data breaches.

Information Security Analyst

Pfizer Inc

Document Management Transformation: 
Led the successful migration of Pfizer's documentation and legacy applications to a centralized document management platform. This initiative involved identifying and evaluating solutions, designing the migration strategy, and overseeing the implementation process, ensuring seamless integration with existing systems.

Championed Single Sign-On: 
Implemented a single sign-on (SSO) approach by integrating the document management platform with Pfizer's identity authentication system. This streamlined user access and improved security by reducing the need for separate login credentials.

Optimized Document Access and Control: 
Developed and implemented a robust access control system within the document management platform, ensuring authorized personnel have appropriate access to sensitive information while restricting access for unauthorized users. This enhanced data security and compliance with relevant regulations.

Accomplishment:
Increased User Efficiency: Improved document access and retrieval for employees by centralizing documentation in a single, searchable platform.

Enhanced Security and Compliance: Reduced security risks associated with legacy applications and improved data access control through SSO and granular permissions.

Reduced Operational Costs: Decommissioned legacy applications and streamlined document management processes, leading to cost savings and increased operational efficiency.

Key Skills:

    Document Management System (DMS) Implementation and Administration
    Identity and Access Management (IAM) Integration
    Single Sign-On (SSO) Design and Configuration
    Data Security and Compliance
    Project Management and Leadership
    Change Management and User Adoption

Cyber Security Analyst

Goldman Sachs

Compliance, Secure Development, and Infrastructure at Goldman Sachs

Led SOX Compliance and Auditability: Led the implementation of comprehensive activity logging controls across all in-scope Linux systems, ensuring complete audit trails for user actions and compliance with Sarbanes-Oxley (SOX) regulations. This initiative significantly improved data security and streamlined the audit process.

Established Secure SDLC Practices: Advocated for and implemented a standardized and secure software development lifecycle (SDLC) within Goldman Sachs. This included establishing a robust change management process with regression testing and backout plans, minimizing risks associated with production code changes, and fostering a culture of secure development.
 
Infrastructure Modernization: Led the successful migration of critical applications from legacy mainframe servers to a modern Enterprise Linux environment. This complex project involved meticulous planning, cross-departmental collaboration, and seamless execution, ultimately enhancing scalability, agility, and cost-efficiency for the company's IT infrastructure.

Impactful Achievements:

Achieved SOX compliance: Enabled comprehensive auditability and addressed identified gaps in activity logging, ensuring Goldman Sachs met regulatory requirements.

Reduced software risks: Standardized and documented change management process minimized production errors and improved overall system stability and performance.

Enhanced IT infrastructure: Successfully migrated to a scalable and cost-effective Linux environment, future-proofing Goldman Sachs' technology landscape.

Key Skills:
SOX Compliance and Security Controls Implementation
Secure SDLC Design and Execution
Change Management and Risk Mitigation
Linux System Administration and Security
Enterprise Infrastructure Migration and Modernization
Project Management and Leadership

Consultant

As the CISO of Careful Security, a leading Cybersecurity Services Provider for small and medium businesses (SMBs). We provide comprehensive and customized security solutions. With over 20 years of industry experience in Fortune 100 companies I have a track record of excellence and innovation in cybersecurity. My core competencies include vCISO, Gap Analysis, Security Advisory, and Strategy. Our mission is to make cybersecurity usable, pragmatic, and bulletproof for the complete protection of our clients.

Taplio

Sammy Basu's Linkedin Analytics

Sammy Basu

Want to drive more opportunities from LinkedIn?

Taplio

.css-1jgreyo{background-image:linear-gradient(284deg, rgba(39,43,72,1) 0%, rgba(33,47,183,1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Sammy Basu's Linkedin Analytics

Sammy Basu

Want to drive more opportunities from LinkedIn?

Sammy Basu's Linkedin Analytics