Team: Application Security
I'm passionate about making security less art and more science. To that end, I've been a fan of applying safety engineering methodologies to security, such as CAST, STPA, and STAMP. I'm also a fan of the SABSA enterprise security architecture framework (a great way for neurodiverse security practitioners to stay organized and solve the right problems)
I live on Vashon Island in Washington State with my wife, 2 kids, 15 chickens, 1 bunny, 3 cats, 2 dogs, and currently 6 foster kittens. I'm a hands-on security engineer with decades of broad and deep experience in security and development. I've done networking, systems administration and hardening, mobile security, identity and access management, security architecture, and software development -- but my niche has been application security. My undergrad degree is in Electrical Engineering. Later, I got a Master's in Computer Science (with a concentration in information security). I like to dabble in geeky electronics projects, get out on the water, and am into recreational tree climbing (a great hobby for someone who likes knots!).
In a relatively short time we've taken a system built to resist destruction by nuclear weapons and made it vulnerable to toasters. — Jeff Jarmoc

.jpg)

I enjoy working to solve big, hairy problems that linger despite widespread awareness, frustration, and past failures to address them.
I prefer impactful work that can make enginer's working lives better.
To be effective, I schedule my priorities and block time to focus and get into a "flow state". I leave time in my schedule to think and synthesize information. I live in a beautiful place so sometimes my best thinking is outdoors on a walk or maybe in a hammock.
I spend a lot of time listening to understand the context of a system or problem-space and how people are currently thinking about the problem. I look for the obstacles that have prevented this problem from being solved as those are often a good place to focus.
Sometimes problems linger because not everyone has a common understanding of the problem or system. I look around corners for better problems to solve.
I don't know everything (Shocker!) but I love to learn. Technology moves too fast - we need to benefit from the combined experience of many people. Synergy is also a great source of dopamine.
When I'm in focus mode, I tend to disable notifications to avoid distractions. I check email and slack a few times throughout the day. If you really need to get my attention, try Signal.
Many people assume I'm "too busy" so don't ask for help -- that's a shame. I can manage my time and I will tell you when I'm booked.
Our team uses JIRA extensively so that's an ideal way to get a request on my radar and for me to make sure it doesn't get lost. To manage my priorities, I need clarity on timelines when you would like a response and absolutely need one.
The outcome of learning is less important to me than the journey.
Human emotions drive human behavior; ignore at your peril.
I actually own a shirt that says "Empathy is a Virtue"
I like to tell dad jokes...
...sometimes, he even laughs!
How you define the problem determines whether you solve it. It's also important to look for better problems to solve.
When Radical Candor is encouraged and supported by [leaders], communication flows, resentments that have festered come to the surface and get resolved, and people begin to love not just their work but whom they work with and where they work. When people love their job, the whole team is more successful. The resulting happiness is the success beyond success.
-- Kim Scott, Radical Candor
Radical Candor involves "Caring Personally" about people and “Challenging Directly”. My approach to mentoring involves both. We all need people in our lives to care enough about us to be honest so we know how we are really showing up.
It's easy to have feedback imbalanced and overly-focused on the negative. I need to have an opportunity to course-correct, but also need to know what I'm doing well so I know to keep doing more of that!
Ask me about...
Visit Jason's Security Corner for security tidbits, blog, and more!