Application Security Vulnerability Management

KWASI ACHEAMPONG

Accomplished Vulnerability Management and Application Security Lead with over a decade of experience fortifying IT infrastructure, cybersecurity, and cloud environments. Expertise in architecting and spearheading comprehensive security programs, integrating SAST (Veracode) and penetration testing (Burp Suite, Metasploit) into CI/CD pipelines and development lifecycles. Proven in securing stakeholder buy-ins to elevate security posture across enterprise systems and AWS/Azure platforms. Key highlights include:

Strategic Security Leadership: Directed and enhanced enterprise-wide vulnerability management and application security programs, demonstrably reducing organizational risk and improving compliance (HIPAA, PCI DSS, NIST).

Advanced Application Security: Proficient in implementing Static Application Security Testing (SAST) with Veracode and Dynamic Application Security Testing (DAST) principles, integrating them into CI/CD pipelines for early vulnerability detection.

Penetration Testing & Threat Identification: Skilled in conducting web application penetration tests using Burp Suite and Metasploit, identifying and remediating OWASP Top 10 vulnerabilities.

Cloud & DevOps Security Integration: Expertise in securing cloud platforms (AWS, Azure) and Kubernetes environments, embedding security controls and best practices throughout the DevOps lifecycle.

Data-Driven Risk Mitigation: Leveraged advanced data modeling and analysis (SQL, Power Query, Excel) to transform vulnerability data into actionable insights and remediation strategies.

Stakeholder Engagement & Training: Successfully developed and delivered security training, fostering security awareness and collaborating effectively with technical and business teams to achieve security objectives.

TECHNOLOGY SKILLS

Category

Technologies & Methodologies

Vulnerability & AppSec Tools

Nessus, Qualys, Veracode (SAST), Burp Suite, Metasploit, DAST (principles)

Cloud Platforms & Security

AWS, Azure, Kubernetes

DevOps & Automation

Jenkins, Docker, CI/CD Pipelines & Security, Git, Ansible, Terraform

Data Analysis & Reporting

SQL, Microsoft Excel, SharePoint, Power Query, Power Pivot

Languages & Scripting

Python, SQL, Bash, PowerShell

Frameworks & Compliance

NIST (RMF, STIG), ISO 27001, PCI DSS, HIPAA, SOC 2, OWASP Top 10

Operating Systems

Linux (Ubuntu, CentOS), Windows Server

Networking & Infrastructure

TCP/IP, DNS, Firewalls, IT Infrastructure Management

PROFESSIONAL EXPERIENCE

Bright Light Medical Imaging October 2022 – Current

IT Specialist / Vulnerability Management

Performed regular vulnerability assessments using Nessus, remediating critical vulnerabilities and ensuring timely patching to maintain compliance with industry standards.

Led the adoption of Veracode for Static Application Security Testing (SAST) on critical healthcare applications, identifying code-level vulnerabilities and guiding remediation to ensure HIPAA compliance.

Conducted targeted web application penetration tests using Burp Suite and Metasploit, validating vulnerability scanner findings and identifying OWASP Top 10 vulnerabilities in patient-facing portals.

Installed, updated, and secured company-wide software and hardware, including healthcare-specific applications, increasing system uptime by 15%.

Connected to multiple data sources (SQL, Excel, SharePoint, cloud databases) and performed advanced data modeling.

Led application security enhancement projects, developing and implementing comprehensive strategies that integrated SAST and DAST principles to protect sensitive patient information.

Collaborated with cross-functional teams (IT, Engineering, Security) to address security issues, significantly reducing system vulnerabilities by 30%.

Developed and executed security training for staff, promoting best practices in network security, resulting in a 50% decrease in phishing-related incidents.

Monitored security certificates and compliance across various platforms, ensuring adherence to HIPAA and other regulatory requirements.

Allied Digital Solutions, Remote (Part-Time Contract) December 2022 – May 2023

Security Engineer

Designed and deployed Kubernetes clusters, optimizing container orchestration for scalable and secure applications.

Integrated Veracode SAST into CI/CD pipelines, enabling automated security scanning of code commits and providing rapid feedback to developers on potential vulnerabilities in containerized applications.

Implemented CI/CD pipelines using Jenkins and Docker, improving deployment efficiency and system stability by 20%.

Utilized Burp Suite and Metasploit to perform security assessments of APIs and web services deployed in Kubernetes, identifying OWASP-related vulnerabilities specific to microservice architectures.

Ensured security benchmarks (STIG, NIST) were met in cloud environments (AWS), enhancing overall security posture by 35%.

Led the implementation of application security controls within the CI/CD pipeline, incorporating SAST (Veracode) and advising on secure container configurations to enhance the overall security of deployed applications.

Provided technical support and maintenance across cloud infrastructure, addressing incidents swiftly and maintaining operational continuity.

A3 Solutions - (Northrop Grumman) April 2022 – September 2022

IT Security Engineer

Managed Tier II helpdesk tickets, resolving 90% of escalated issues within SLA, and ensured seamless system functionality across multiple field offices.

Conducted Qualys and Nessus risk assessments, mitigating critical vulnerabilities and ensuring system compliance with organizational security policies.

Utilized Veracode to assess the security of key desktop applications, contributing findings to enterprise application security efforts and risk assessments.

Applied Burp Suite and Metasploit knowledge to assist in security assessments of enterprise applications, identifying OWASP vulnerabilities and validating scanner findings.

Contributed to the management of application security risks by participating in security assessments, developing secure configuration guidelines, and assisting with remediation tracking for enterprise applications.

Utilized Power Query and Power Pivot to import, clean, and transform large datasets efficiently.

Supported field offices by addressing hardware and network issues, ensuring minimal downtime.

Pactiv Evergreen July 2013 – April 2022

IT Risk Analyst – Third-Party Risk

Led third-party risk assessments, ensuring vendor compliance with PCI DSS and NIST RMF frameworks, reducing overall third-party risks by 25%.

Managed the configuration and deployment of Nessus Essentials for vulnerability scanning, increasing vulnerability detection across the network by 40%.

Contributed to application security assessments by performing initial SAST evaluations using Veracode, identifying foundational code vulnerabilities in key internal systems.

Supported vulnerability management by utilizing Burp Suite and Metasploit to validate critical findings from Nessus scans and gain early experience with OWASP Top 10 vulnerabilities.

Developed and maintained risk control frameworks, ensuring that internal and external security risks were documented and mitigated effectively.

Participated in the development of application security guidelines and awareness programs, contributing to the integration of security principles within the broader IT risk management strategy.

Built interactive dashboards and data visualizations to track KPIs and trends across millions of records.

Collaborated with cross-functional teams to prioritize risk mitigation strategies, reducing critical risks by 30%.

EDUCATION & CERTIFICATIONS

College of DuPage – Associate Degree in Information Technology (September 2014)

Western Governors University (WGU) – B.S. in Cybersecurity and Information Assurance

McCombs School of Business, University of Texas at Austin – Post Graduate Program in Cloud Computing (February 2023)

AWS Certified Solutions Architect - Professional (2023)

Microsoft Certified: Azure Security Engineer Associate (2023)

CompTIA Security+ (2022)

Cisco Certified Network Associate (CCNA) (2022)

NIST 800 Series: Certified in RMF & C

CompTIA A+ (2022)

CISA Certification Pending

Contact this candidate