Raymond A. Pompon, CISSP

Security leader responsible for developing security program that passed nine annual SAS-70/SSAE-16 SOC-1 Type II audits/li>
25 years in infosec and compliance (GLBA, ISO 27000, Sarbanes Oxley, PCI, FFIEC, PIPEDA)
34 years building complex network security designs and implementations with an emphasis on high-availability and security
19 years experience in leadership including owning a network integration firm, leading threat research team, ensuring profitability for consulting division and leading IT Ops team
22 years experience in web application security analyzing, auditing and meeting OWASP and WASC requirements
Proven writer and speaker in infosec topics including 150+ security articles, media interviews, 200+ public talks, and published book.
Author, IT Security Risk Control Management: An Audit Preparation Plan, Pub Oct 2016

Professional Experience

Cyber Security Program Director Convera - 2022 to Present

Manage cybersecurity programs and policies for B2B processing $110B in transactions in 40+ countries and territories and 140+ currencies
Run Governance, Risk, and Compliance program for a 6-person team under the CSO
Ensure compliance with global cybersecurity financial regulations including GDPR, PSD2, NYDFS, FFIEC and SOC1 Type 2 audit
Manage cyber-risk management, business continuity, vendor risk, customer assurance, and security awareness for 2000 employees and contractors

Director F5 Labs, Threat Intelligence F5 Networks - 2016 to 2022

One of the founders and team lead for F5 Labs, the 5-person team of threat researchers
Developed first annual Application Protection Report from multiple data sources and created annual process to handoff as an ongoing series.
Conducted numerous interviews of CISOs, CTOS, and tech leaders to produce case studies, tutorials, and best practices.
Wrote data analysis code and developed process for large scale honeypot data for sales and on-going threat reports.
Mentored and ran F5 Labs internship resulting in published research and new open source security tools
Develop and define content for CISO-to-CISO, F5 Labs information source for Security Leaders
Speaking, writing, podcasting, and support of strategic sales efforts
Principle Threat Researcher Evangelist: 2016-2020, Director: 2020+

Head of Information Security, North America and Asia, Linedata - Sep 2016 to Dec 2016

In charge of security and compliance for 4 Linedata offices and 4 ASP hosting data centers for financial services companies.
Design and execute three SSAE 16 SOC1 and SOC2 audits for 2 data centers
Hire and manage information security staff that oversee corporate and hosted security as well as manage compliance projects
Primary lead for customer security inquiries and all external audits

Director of Security, Linedata Lending and Leasing (formerly CapitalStream) - 2013 to 2016

Responsible for security and compliance at Lending & Leasing division by ensuring continued passing annual SSAE-16 SOC-1 Type II audits and zero breaches
Headed security and compliance for new mobile financial services product offering
Developed internal security tool which was later packaged and sold as a product add-in for customers
Promoted security offerings by publishing magazine articles, giving press interviews, and presenting at financial industry conferences
Enhanced sales by briefing customers on security, privacy and compliance assurance programs

Director of Security and Infrastructure, HCL CapitalStream - 2008 to 2013

Managed infrastructure team responsible for highly available, highly secure financial services hosting environment
Led multi-year sustained web application security project that boosted organization to 100% OWASP compliance and zero security flaws. Reduced vulnerability fix time 400%, faster than industry avg.
Guided IT operations team through passing Verizon Cybertrust / ISO 27001 certification for three years in a row
Managed special security projects to meet customer requirements for security and international compliance including database encryption, PCI compliance, and privacy audits

Security Officer, CapitalStream - 2007 to 2008

In charge of security and compliance for a financial services ASP that hosts several top 50 global banks
Change leader in creating a ground-up comprehensive new security program that eliminated customer audit deficiencies and successfully passed SAS-70 Type 2 audit
Reduced operational expenses by over 20% by creating new change control processes, reducing vendor expenses, and developing new cross-platform change monitoring software with scripting tools
Worked directly with the IT operations team to identify and resolve security incidents including interfacing with law enforcement, customers and auditors

ISMS Manager, Network Computing Architects - 2006 to 2007

Led information security management systems practice within NCA Professional Services
Performed pre-sales consulting and fulfillment for ISO 27001 certification projects
Designed methodologies for policy development, and service fulfillment for consulting engagement teams
Developed new customer offering for risk assessment based on Failure Mode Effects Analysis
Headed long-term security project for a large-scale e-commerce firm for PCI remediation
Designed and maintained risk assessment and ISMS implementation sub-practices

Internet Security Consultant, Creation Logic - 2005 to 2006

Engineered and implemented large-scale satellite-based VPN & firewall infrastructure
Performed on-site security inspections and redesigns for financial service firms

Senior Security Architect, Conjungi Networks - 2000 to 2005

Civilian undercover operative in FBI Operation Flyhook that led to conviction of two Russian hackers
Created and expanded vulnerability assessments and penetration testing business services - performed assessments for national retailers, banks, financial services firms, energy utilities, and e-tailers
Participated in and contributed to creation of intellectual property and new consulting services, security products, and customer offerings
Performed security analysis and due-diligence review for third-party service providers, outsourcers, and financial services firms
Designed and implemented a nation-wide secure highly-available POS system with 300 remotely managed firewalls, VPNs and Firewall management system
Acted as primary responder in a variety of security incidents including rogue sysadmin, large scale malware outbreaks, e-banking breach
Many projects performing risk analysis, technical architecting, installation, integration, and support for HIPAA, Sox, PCI, GLBA, and NERC regulated organizations

Network & Data Security Analyst, Boeing Employees Credit Union -1997 to 2000

Maintained and secured all internal, external LAN, WAN and Internet data communications
Designed, built and maintained Internet security for BECU's first web banking offering
Demonstrated assurance through on-going internal and external technical audits.
Provided highest escalation support position for 1,000+ node financial network

Founder, Minuet - 1994 to 1997

Ran technical and business operations for 3 employee systems integration firm
Company specialized in LAN integration and Internet connectivity for CPAs, Tax Attorneys
Provided design, project management, cabling, OS migration, software conversion, training

Senior Technology Specialist, KPMG Peat Marwick; -1991 to 1994

Lead manager for 150 CPAs on Netware LAN of Windows and Mac hosts

Systems Technician, Chaminade University - 1990 to 1991

Sysadmin for Academic Support dept. Managed Dec PDP-11/44, SCO Unix and Novell Netware

Affiliations

FBI, Seattle, Delaware InfraGard Member Alliance, executive board, 2001-2012 Seattle, 2017-2023 Delaware, Treasurer 2018-2023, InfraGard Sector Chief Financial Services 2015-2023
ISC, Delaware Chapter, Membership Chair 2019+
Cyber Finance Working Group (CFWG) as part of the Executive Partnership for Integrated Collaboration with the FBI Washington Field Office - 2020+.
FBI Citizen's Academy, class of 2006
University of Washington,Information Assurance certificate program, advisory board(2005-present)
University of Washington, Certificate program in Information Systems Security, advisory board (2006-present)
University of Washington, IT Audit certificate program, advisory board (2012-2014)
HoneyNet Project - Pacific Northwest Chapter, Member 2012-present
Richard Hugo House, Board member (2005-2010)
Dept. Homeland Security, Northwest Warning, Alert, and Response Network, advisory board member (2002-2004)
US Secret Service, Seattle Electronic Crimes Task Force, consultant (2000-2004)
Washington Software Alliance Security SIG, speaker and participant (2000-2004)
Web Application Security Consortium, contributing author
Society of Information Risk Analysts, Professional Member
OWASP Mobile Top Ten 2015, Reviewer

Education

Bachelor of Arts: Lib. Studies - Information Technology, University of Hawaii, 1990.
Certificate in Data Communications, University of Washington, May 1999.

Certifications

Certified Information Systems Security Professional, 2008+
AWS Certified Solutions Architect, Associate Level, 2016
GIAC Law of Data Security & Investigations (GLEG), 2015
ISO 27001 Lead Auditor, International Register of Certificated Auditors, 2006
Novell Certified IntraNetware Administrator, 1998
Cisco Certified Network Associate, 1998
Microsoft Certified System Engineer, 1997
Certified Computing Professional in System Management, 1992

Other

Creator and artist, Heidi Geek Girl Detective
Security blogger at http://assumebreach.blogspot.com/

@ 2024 Raymond Pompon Contact Me

Raymond A. Pompon, CISSP

Professional Experience

Cyber Security Program Director Convera - 2022 to Present

Director F5 Labs, Threat Intelligence F5 Networks - 2016 to 2022

Head of Information Security, North America and Asia, Linedata - Sep 2016 to Dec 2016

Director of Security, Linedata Lending and Leasing (formerly CapitalStream) - 2013 to 2016

Director of Security and Infrastructure, HCL CapitalStream - 2008 to 2013

Security Officer, CapitalStream - 2007 to 2008

ISMS Manager, Network Computing Architects - 2006 to 2007

Internet Security Consultant, Creation Logic - 2005 to 2006

Senior Security Architect, Conjungi Networks - 2000 to 2005

Network & Data Security Analyst, Boeing Employees Credit Union -1997 to 2000

Founder, Minuet - 1994 to 1997

Senior Technology Specialist, KPMG Peat Marwick; -1991 to 1994

Systems Technician, Chaminade University - 1990 to 1991

Affiliations

Education

Certifications

Notable publications

Speaking (selected)

Media

Other