Email address: yanyan.wang at outlook *************************************************************** Seasoned software security engineer with mixed background in both application and information security. Adept at communicating with other engineers and clients in a clear and understandable manner. Proven ability to initiate and resolve complex projects; demonstrated success in taking on challenging new assignments with minimal directions.

Senior Application Security Architect @ - Architect and design security solutions that enforce security consistently across internally developed applications - Analyze static code reports for false positives, prioritization of vulnerabilities, and assist in the research and remediation steps as needed - Consulting with development teams on security practices during all phases of the SDLC - Lead scrum teams on secure review of application design, development and testing - Develop application security policy and standards/best practices - Evaluate new and emerging security technologies, features, and products From August 2014 to Present (1 year 5 months) San Francisco Bay AreaApplication Security Engineer @ - Performed manual and automated penetration tests and code audits both manually and with automated tools including Fortify, Zap, Burp, sqlmap, tamper data among others. - Cooperate with product managers, leads and engineers to prioritize and mitigate security issues. - Took personal responsibility for the security of the Twilio platform. From December 2013 to August 2014 (9 months) San Francisco Bay AreaSenior Software Security Consultant @ One of the Professional Service members, we assessed and scoped customer's application security needs; communicated technical application security concepts to customer staff including developers, architects, and managers; and offered plans for remediation of vulnerabilities. - Designed and implemented software security assurance programs and integrate HP Fortify to client’s SDLC processes - Trained and mentored developers on secure coding and HP enterprise security product - Contributed to project planning and other project deliverables - Collaborated with Product Management and Engineering to enhance products - Reviewed and audited customer source code; Installed, configured and troubleshooted HP Fortify products From November 2011 to December 2013 (2 years 2 months) Senior Software Security Consultant @ - Led the implementation of OWASP ESAPI from conceptual to production. - Mentored and coached programmers and team leads on application security and ESAPI usage. - Conducted application design and source code review. - Coordinated with developers, architects, and security teams to remediate application vulnerabilities. - Implemented SDL policy, secure coding standards and guidance. From January 2011 to November 2011 (11 months) Information Security Analyst @ Maintained policies and standards, Tripwire, vulnerability assessment program and web pen-testing. - Implemented application penetration testing using AppScan - Introduced source code review and secure application development concepts - Configured and managed Tripwire - Developed Perl script to search log files for PCI compliant patterns - Created and maintained policies, standards for network devices, Linux and Windows in compliant to NIST and CIS standards - Managed vulnerabilities for Linux, Windows, firewalls, and routers using tools including Nessus, NMAP, RAT, ftester, MSBA, Tiger. - Applied Octave methodology for risk assessment. From 2010 to 2010 (less than a year) Application Security Consultant @ One of the three member team that oversaw security risks of network integration and produced results under tight deadlines in coordination with various departments and teams. - Reviewed security architect for two major investment banks - Led vulnerability assessment on OS on various platforms (Linux and Windows) and databases (MSSQL, MYSQL, Sybase, Informix, DB2) - Created security policies, standards and hardening guidance for OS, databases, and networks - Assisted application security review both dynamic and static; and network security (switches, routers, and firewall). From 2009 to 2010 (1 year) Vulnerability Manager @ The sole team member on the security team, I managed vulnerability assessment program for the entire university and assisted on policies and standards. - Implemented and maintained a vulnerability assessment program by performing bi-weekly vulnerability scanning and reporting for sixty-four different departments - Automated the vulnerability scanning and reporting using Perl and MySQL - Worked with system admins in all sixty departments to mitigate vulnerabilities and provided advices when needed - Assisted in incident responses and forensic analysis - Assisted drafting information security policies, standards, proposals, and documentations - Monitored intrusions using Cisco MARS From 2007 to 2009 (2 years) Orlando, Florida AreaResearch Assistant @ Created driving simulation programs, and developed websites using ASP .NET, C# .NET From 2005 to 2007 (2 years) Technical Support Specialist @ Tasked for software/hardware installation, troubleshooting and user training From 2002 to 2003 (1 year)

Master, Management of Information System @ University of Central Florida From 2003 to 2005 Master, Computer Engineering @ University of Central Florida From 2001 to 2005 YanYan Wang is skilled in: Security Architecture Design, Threat Modeling, SDL, Secure Code Review, Application Security, Cloud Security, Penetration Testing, Information Security, Security, Vulnerability Assessment, Computer Security, Network Security, Nessus, Vulnerability Scanning, Java