Bishop Fox

VP of Consulting & Cosmos Delivery

Associate Vice President of Consulting

Practice Director, Application Security

Shared Security Podcast

Shared Security is a weekly podcast that explores the bonds shared between people and technology. Every week we bring you timely stories, news and tips for living more secure and private in a connected world. Subscribe wherever you get your podcasts or listen direct on sharedsecurity.net.

Founder and Host

Veracode

Sr. Manager of Penetration Testing

Performed daily management and leadership for a high-performance team of seasoned penetration testers and conducted practice management for Veracode's Manual Penetration Testing service. 

I'm actively involved in customer engagement and provide subject matter expertise in Penetration Testing for our Sales and Services teams.  I'm significantly involved in pre-sales activities helping sell and position Penetration Testing as well as other Veracode services and technology. 

I've also developed and implemented new Penetration Testing services, improved our existing services, developed operational processes, and work to ensure high customer satisfaction through direct customer engagement. Part of my practice management duties include planning and implementing team budgets, provide capacity model planning, and ensure a high profit margin for continued growth of my practice.

I was awarded Veracode’s Services Manager of the Year in 2015 and was a 2016 Veracode Founders Club winner.

Manager of Penetration Testing

SecureState

Managed day to day operations of a team of highly skilled penetration testers and network defenders

Led the Attack & Defense practice to create over 10 new and innovative services

Conducted personnel reviews, tracked performance metrics and mentored career development

Managed P&L, operating budgets, revenue generation and sales pipelines for the practice

Created, reviewed and maintained high quality client deliverables

Managed the pricing, time estimates and developed custom solutions for clients and complex engagements including responses to complex RFP/RFI requests 

Helped initiate and participated in over eight successful marketing campaigns

Worked directly with sales and client C-level executives before, during and after engagements to position additional services and exceed customer expectations

Led hundreds of sales calls, strategy meetings and gave presentations to leaders of businesses large and small

Conducted and managed red team penetration testing, social engineering, web and mobile application security assessments, physical security and blue team defensive services

Developed, improved and sold mobile application security, physical threat assessment, network and application security architecture reviews and secure SDLC services 

Developed PCI, HIPAA, GLBA, SOX and other regulatory solutions for clients

Created training and was the lead instructor for multiple classes including secure code training for developers, security awareness and hands-on penetration testing

Presented my research at multiple national and international security conferences including Black Hat, DEFCON, ShmooCon, DerbyCon, SANS, OWASP AppSec and InfoSec World

Principal Consultant

Senior member of the Profiling Team.  I managed and conducted various assessments for clients including web application, physical, social engineering, wireless and network penetration tests.  I'm also the lead trainer for OWASP Web Application Security Training for developers and led SecureState's web application assessment offerings.

Senior Security Consultant

Security Justice Podcast

I co-hosted and was one of the original founders of the Security Justice Podcast.  Security Justice was a popular Information and Physical Security Podcast.

Founder and Co-Host

Northeast Ohio Information Security Forum

I led meetings, recruited speakers, and promoted the organization to the local and national Information Security community.

Board Member

KeyBank

I was the vulnerability assessment and penetration testing team lead. I organized, managed, and conducted security assessments which included networks, web applications, physical security, and social engineering.  The last several months at Key I specifically focused on web application assessments.

I took over, redesigned and developed the current Security Posture Assessment (SPA) program being used today.  This program has evolved to include "red team" assessments that are focused on client side and physical attacks which include social engineering aspects.  These assessments are all run by an internal team.  I also created a automated program to conduct phishing awareness of employees.

Other duties included approving firewall change requests, assisting with the implementation of a social media policy, providing ongoing social media monitoring (specifically for security issues) with a toolkit and process I created, and leading the technical aspects of various enterprise level security projects.

When hired in 2006 I was in charge of the ArcSight implementation.  I coordinated and managed a major ArcSight upgrade as well as tuned and updated correlation rule sets and implemented custom log agents.

Senior Information Security Consultant

Forest City Enterprises Inc.

I was part of the initial team at Forest City that helped build a information security department from the ground up.  This included building policies and procedures and assisting the IT Security manager with creation of IT general controls to meet Sarbanes Oxley 404 requirements.  Other responsibilities included leading and implementing multiple enterprise security projects including the deployment of a MSSP for 24/7 network monitoring.  I also conducted risk assessments, provided security awareness training for employees and worked with an outside vendor to complete the first full penetration test of the Forest City network.  Other duties included enterprise vulnerability management, enterprise patch management, forensic investigations and Bindview administration for audit and compliance purposes.

Senior IT Security Specialist

Project lead for the design and implementation of Microsoft Software Update Services (WSUS) as well as implementing McAfee ePolicy into the Forest City corporate environment.  I re-designed and managed the backup infrastructure for Forest City.  Conducted daily management of backups and restores for over 80 servers including all regional offices.  I managed all Exchange 2003 servers in the corporate and regional offices and conducted daily high-level management of the email environment.  

I was also the go to person for Active Directory and Microsoft Windows security while in this position.  I became extremely knowledgeable of Windows security vulnerabilities as well as the use of GPO's for corporate compliance.

Network & Back Office Administrator

Cap Gemini

My primary responsibility at Cap Gemini was to provide third level help desk support assisting users with Windows 2000 domain level issues and the Active Directory infrastructure.  I managed over 80 domain controllers, 5000 users, 200 standalone servers and over 300 group objects.  I maintained local site backups with for over 80 domain controllers in the US and Canada.  I also assisted in the management of the Cleveland Data Center HP-UX SAN environment.  Additional duties included creating and implementing a Active Directory disaster recovery plan, lead the Microsoft Software Update Services deployment to over 300 Servers in the US and Canada, assist with the Lotus Notes to Exchange email migration and help develop internal ASP.NET applications for managing Active Directory.

Active Directory Administrator

Accenture

Conducted desktop PC and networking support to the Cleveland Accenture office as well as other national offices.  Lead several local projects including large PC refresh initiatives.

Desktop Support Specialist

I'm an accomplished leader, team manager, and cybersecurity professional known for my unique blend of technical expertise and leadership skills. With a track record of speaking at events like SANS, OWASP AppSec, ShmooCon, DEF CON, Black Hat USA, and international conferences, I bring valuable insights to the cybersecurity field.

As the founder and host of the Shared Security Podcast and a former co-founder of the Security Justice Podcast, I have a passion for sharing knowledge in the industry.

Specific areas of expertise include: Team Building and Leadership, Vulnerability Management, Offensive Security, Security Compliance, Penetration Testing, Red Teaming, Application Security, DevSecOps, Web Applications, Data Privacy, Product Security, Attack Surface Management, Physical Security, Social Engineering.

Taplio

Tom Eston's Linkedin Analytics

Tom Eston

Want to drive more opportunities from LinkedIn?

Taplio

.css-1jgreyo{background-image:linear-gradient(284deg, rgba(39,43,72,1) 0%, rgba(33,47,183,1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Tom Eston's Linkedin Analytics

Tom Eston

Want to drive more opportunities from LinkedIn?

Tom Eston's Linkedin Analytics