Drew B

Senior Product Security Engineer

TP-Link • Período integral

Dec 2025 - Present • 10 mos

• Lead a team of junior security engineers and penetration testers. • Performed penetration testing on mobile applications, embedded devices, and cloud infrastructure for Research & Development teams. • Was responsible for tracking vulnerabilities in projects throughout the Secure Product Development Life-cycle (SPDL) from acknowledgment to full remediation. • Acted as Security Architect in reviewing design documents, analyzing security standards, helping Developers implement proper AuthN/AuthZ in API implementations, helping Product Managers implement proper roles and permissions in product environments, and performing threat modeling iteratively throughout the SPDL. • Assisted Project Managers in securing industry standard certifications for hardware projects and software services. • Verified external findings submitted to our bug-bounty program, provided root cause analysis, assisted technical support teams in assessing risk, and provided recommendations for remediation. • Gave quarterly technical training to Developers about the latest trending vulnerabilities affecting our products. • Kept up-to-date on latest exploit techniques, risks/threats, and security trends in order to disseminate relevant information to development teams and emulate tactics, techniques, and procedures used by real attackers. • Developed Python and Bash scripts to develop tools and automate repetitive tasks for efficiency as well as maintaining tool dependencies and updating the product security testbed. • Wrote security baseline test-case documents, vulnerability reports, and proof of concept exploits.

Senior Penetration Tester

Oracle • Período integral

Mar 2022 - Dec 2025 • 3 yrs 9 mos

• Performed penetration testing on custom web applications and cloud infrastructure for global development teams. • Was responsible for tracking vulnerabilities in projects from acknowledgment to full remediation. • Kept up-to-date on latest exploit techniques, risks/threats, and security trends in order to disseminate relevant information to development teams and emulate tactics, techniques, and procedures used by real attackers. • Developed Python and Bash scripts to develop tools and automate repetitive tasks for efficiency. • Performed vulnerability scans with the help of tools such as Burp Suite Pro, QualysGuard, and Nessus. • Modified Proof of Concept (PoC) exploit code in languages such as C/C++ and Python.

Security Services Consultant

Synopsys • Período integral

Aug 2018 - Mar 2022 • 3 yrs 7 mos

• Performed internal and external penetration tests on web applications and network assets for Fortune 500 clients. • Part of the Network Security and Red-Team practice, was responsible for performing phishing and network assessments at an enterprise level. • Performed tailored reconnaissance, created and managed offensive infrastructure, exploitation of various technologies, lateral movement in the post-exploitation phase, and established persistence to accomplish goals set by the client. • Managed projects, provided technical oversight, and presented assessment findings to managerial and technical teams. • Kept up-to-date on latest exploit techniques, risks/threats, and security trends in order to disseminate relevant information to clients and emulate tactics, techniques, and procedures used by real attackers. • Recorded and edited videos for the Instructor Led Training (ILT) practice and became a certified instructor to teach a course on attacking networks. • Handled confidential client data and verified remediation of client assets. • Developed Python and Bash scripts to develop tools and automate repetitive tasks for efficiency. • Performed vulnerability scans leveraging tools such as Burp Suite Pro, IBM Appscan, and Nessus. • Developed and modified Proof of Concept (PoC) exploit code in languages such as C/C++, Python, and x86 ASM.