Mark 🪢 Szewczul

• 12th NTX ISSA Cybersecurity Conference: “Threat Detection in Boundaryless Environments” panel 9/6/2024. • CISO XC Conference: “Staying Compliant in Cloud Security with AI” panel 4/25/2024. • CISO XC Conference: “Modernizing InfoSec: Staying in compliance with cloud & data security” panel 11/21/2023. • Hexcon23: “Securing the Future: The Intersection of Security and AI” panel 11/20/2023. • 11th NTX ISSA Cybersecurity Conference: “Practical Tips for Career Advancement” panel 11/15/2023. • Mastering 5G Network Design, Implementation, and Operations Books, Gallery Quote, published June 2023. • The DemoForum Zero Trust Platforms and DSPM Cybersecurity Meetup, Guest Speaker, online 4/4-6/2023. • DevNetwork API & Product Advisory Boards, September 2022 to Present. • AutoCyberSecurity Conference, Shanghai, China: “Public Domain Security for Vehicle Systems” 3/19-20/2020 (cancelled due to Covid-19 pandemic). • 7th NTX ISSA Cyber Security Conference: “Can IoT Systems be Secured?” 11/15/2019. • Industrial IoT World Conference, Atlanta, SME Panel: “Creating best practices and protocols for flexible IoT Security” 11/1/2019. • Industrial IoT World Conference, Atlanta, Analyst Breakfast Briefing: “Why IoT needs ML for higher adoption rates” 10/31/2019. • Industrial IoT World Conference, Atlanta; SME PANEL: “Using a comprehensive, multi-layered approach to solving cybersecurity weaknesses” 10/30/2019. • Texas Cyber Security Summit, San Antonio, “CSA IoT Security Controls Framework” 10/10/2019. • LASCON-Austin “ML-Based Detection Engine of Device/ Network Attacks for IIoT Gateway”10/25/2018. • University of Texas-Dallas, Tech Talk “Mobile Threat Defense” 8/27/2018. • IAFCI North Texas Chapter Meeting “The Mobile Threat Landscape” 7/10/2018. • ISACA-Austin “On-Device Mobile Threat Detecting using ML” 4/4/2018. • Symposium on Securing the IOT 3/5-7/2018, San Francisco. • International VDI Conference, Germany – IT Security for Smart Manufacturing: “Embedded Security

Temporary contract with Fortune 50 manufacturer.

• Developed and led the application security strategy and program across the organization. • Worked closely with development teams to integrate security practices into the SDLC, including threat modeling, secure coding practices, security testing, validation and vulnerability management. • Led security assessments, code reviews, and penetration testing efforts to identify and mitigate security vulnerabilities in applications. • Developed and maintained security policies, standards, and guidelines related to application security. • Drove the selection and implementation of application security tools and technologies. • Directed the implementation and maintenance of security controls to safeguard sensitive information and company assets. • Communicated security risks and strategies to stakeholders, including executive leadership, in a clear and effective manner.

• Leveraged MITRE frameworks and Cyber Threat Intelligence (CTI) to compile Attack/Adversary Playbook for Red/Blue Team operations for Product Security & Incident Response Teams (PSIRT). • Ensured that Nokia’s portfolio is compliant with customer and regulatory security requirements. • Established the wide governance on product security for Nokia systems, with one focus on API security. • Serviced security requirements and security regulations for Telecom, Enterprise, and Government markets. • Evolved the vulnerability management platform ‘VAMS’ for the Nokia product portfolio which allows the Nokia product lines to identify vulnerabilities in the product and ensures fast fixes/disclosure to customers. • Identified and evangelized best practices for product security both externally and internally to Nokia and ensured that they are adopted as appropriate. • Developed the ASTaR (Advanced Security Testing and Research) End-to-End lab in Dallas for security testing with a focus on 5G solutions to prioritize test scenarios and execution in cooperation with the Business Groups, with results delivery.

As SME on Scheme Committee, was key contributor to the industry's first, vendor agnostic, IoT Practitioner Certification for professionals, IoT Security Practitioner Certification, as well as the Artificial Intelligence Practitioner Certification, all released. https://certnexus.com/certification/

• Mentored and Directed Security Analysts, Engineers and Architects. • Led the Shift-Left strategy with Development and DevOps teams while composing enhanced SDLC Standard. • Worked with Development and Operations on enhancing existing security posture of APIs. • Designed security solutions that enforce security consistently across internally developed, commercial-off-the-shelf (COTS) and cloud-based applications and platforms (AWS, Azure) leveraging IAM, KMS, VPC. • Performed security architecture reviews for secure, private, and compliant production datacenters (PCI, FedRAMP) leveraging Third-Party Risk Management tools (SCA, SAST, DAST, BitSight). • Performed various Risk Assessments, Threat Modelling in order to advise for proper tradeoffs with business. • Led design reviews with Development and Operations teams. • Developed procedures to automate CD-CD pipeline security during code builds, testing and deployments. • Collaborated with product and platform teams to maximize DevSecOps automation goals. • Worked directly with Security Operations Center (SOC) and Technical Vulnerability Management (TVM). • Member of Change Board and Vendor Risk Management for various ISMS procedures towards ISO 27001/27002, NIST CSF. • Representative as Infosec Privacy Expert for Legal Department intake towards GRC.

• Used Application Security tools within LLVM compiler toolchain to obfuscate application code/bitcode within the Secure SDLC. • Demonstrated advanced understanding modern security concepts: malware, cryptography, disassembly, reverse engineering and exploitation methodologies. • Utilized VMs, Containers, Linux, Python, JavaScript, Java, JSON, XML, Network stacks to demonstrate various POCs, including CI-CD pipelines, eg. Jenkins. • Leveraged pentest tools such as Frida, JADX, bytecode-viewer, IDA Pro, Hopper. • Provided consistent, proactive, technical leadership and expertise to ensure the success of the implementation and integration. • Trained customer’s software architects, developers and security engineers in Arxan’s technology and security best practices.

• Recommended key decision points for technology direction and contributed to comprehensive technical roadmaps for the vehicle ecosystem with the right balance of tradeoffs for security/privacy and customer experience. • Converted business requirements into working solutions by creating Secure Application Development and Privacy Policies (PCI, GDPR, CCPA), DevSecOps, Threat Modeling ECUs, Root of Trust/Secure root Purple Team, CI-CD pipelines for any secure vehicle endpoint to backend server workflow for Toyota TMNA and other Toyota Entities (AWS, Azure, Embedded and Mobile focus). • Made recommendations on best-of-breed vendor solutions and tools for mobile, server, embedded and safety using common frameworks (NIST, OWASP, CSA, IEC 61508, ISO 26262, SOTA, PKI, IAM). • Evaluated technology with trials and POCs for mobile/server workflow. • Worked with development teams on implementation with agile improvements. • Represented Toyota Vehicle Security at SAE J3061 Cybersecurity for Cyber-Physical Vehicle Systems. • Represented Toyota Vehicle Security at SAE J3138 for Diagnostic Link Connector Security.

The goal of the EC-Council Security of IoT Program is to create a certification to address the security aspects of the growing Internet of Things field.

Thesis option, Information Science and Systems concentration. Conference paper: • Conference on Information Sciences and Systems: "Effect of Censoring In Detector Robustness and Performance in Nominally Laplace Noise," The Johns Hopkins University. Term papers/projects: • Modulation Theory: “The Performance of the Viterbi Algorithm for Convolutional Decoding: Hard vs. Soft Decision and Window Length Effects” • Estimation and Detection Theory: “Robust Signal Detection” • Data Compression: “The FBI Fingerprint Image Compression Standard”