Chris Woodbury

Technical lead for security at Braintree (part of PayPal). With my team and others, I secured billions of payments per year and hundreds of millions of stored credit cards. - Provide expert security guidance through a consulting relationship with other engineering teams. I collaborate with the teams to architect and design systems to meet security requirements, pair on code changes, and review pull requests. - Design, build and maintain security services and libraries, involving SAML-based single-sign-on, data encryption and decryption, and key management. I’ve worked on migrating services to Kubernetes, migrating to cloud, and keeping up with evolving practices for monitoring. - Design, build and maintain security features in the Braintree platform, including step-up authentication for critical actions, recovery mechanisms for compromised accounts, and defenses against automated attacks. - Respond to vulnerability reports and security incidents, leading the response from a security standpoint and working with other engineering teams, as well as upper management, legal and other non-engineering teams. - Collaborate with other technical leaders to set strategic technical vision and guide engineering culture. - Work to increase inclusion and diversity. On a cross-functional committee, I have proposed changes to the Braintree engineering interview process to improve consistency and inclusivity. - Work to integrate Braintree, formerly an autonomous business unit, into PayPal. I work to update PayPal policies to accommodate Braintree practices, and I have helped adopt PayPal security policies and implement necessary changes at Braintree. - Address security questions and concerns from customers and prospects, collaborating with coworkers outside engineering and talking directly with customers via email and calls. - Coach and mentor engineers both on and off the security team. Although the credit is theirs, two of my coachees have received promotions.

Member of team developing a proprietary network reconnaissance tool and vulnerability scanner, written in Ruby. - Implemented support for network protocols (using available documentation and reverse engineering), for use by vulnerability tests. - Developed techniques for fingerprinting protocols and applications. - Researched vulnerabilities discovered by third parties and wrote tests to reliably detect those vulnerabilities. - Created and open-sourced the net-tns gem (https://github.com/SpiderLabs/net-tns), a Ruby library for connecting to Oracle DB that incorporated my own original research and the work of others. - Developed tools and systems for managing workload (e.g. new vulnerabilities) and automating common and/or complex tasks. - Analyzed production data to improve the performance and accuracy of the scanner. - Continued to contribute to Nmap, patching bugs and submitting several new runtime options for core Nmap.

Indepedent researcher focusing on techniques for network reconnaissance, implemented via numerous improvements to Nmap. Collaborated with Nmap maintainers to integrate these improvements into the Nmap project, primarily through scripts and libraries for the Nmap Scripting Engine (NSE). - Significantly improved support for Microsoft SQL Server, including improved detection and version identification, support for communication via named pipes, and better user options for targeting instances. - Built features to reliably obtain a Windows host's hostname, domain name, forest name and FQDN, without authenticating. - Identified and patched several bugs in scripts and libraries for Microsoft SQL Server and SMB. - Began implementation of the NetBIOS protocol suite, along with several associated Microsoft networking protocols, including the Browser protocol, the Mailslot protocol and RAP (Remote Administration Protocol).

- Responsible for methodology and all technical aspects of penetration testing services for 25-person Information Security & Privacy group. - Managed project teams and delivered penetration tests, network security audits, vulnerability assessments, software security reviews and other information security services. - Consulted with clients primarily in banking and insurance industries. - Led efforts that delivered significant efficiency gains in pen-testing services. - Developed numerous scripts, templates and other tools to automate, improve and standardize processes. - Proposed and led overhaul of client reports to improve readability, quality and focus. - Developed and taught five internal training courses.