VIVIAN VAL, CISSP

Irvine, CA | 714-880-2466 | vivianval@ymail.com

Security ||DevSecOps Engineer.

I have over 10 years of combined IT experience, of which the last five years has been within Security and the
Devops realm. I am very passionate about new technologies, open-sources projects and knowledge sharing.
I’m particularly enthusiastic about the DevSecOps mindset, and automation methodology. For me DevOps is
first, a methodology to help company in their digital transformation.

As a DevSecOps specialist, coming from networking and security background, I believe I am a good fit for
helping companies make digital transition to the DevOps world/ecosystem which involves mindset,
methodologies, tools and practices.
Also, I improve end to end DevSecOps toolchain with CI/CD, Containerization, Container orchestration, GitOps,
Security, Infrastructure as Code and Observability.

My ultimate goal is to be a part of a group of motivated engineers creating secure applications, making sure
security is defined early in the #SDLC process; during requirement gathering, a process known as "shift left".
I am a leader, and very committed to excellence.

TECHNICAL SKILLS

Security: Advanced use of intrusion-detection, IDS/IPS, DLP, SIEM like Splunk, LogRhythm,
Ms Sentinel, etc. vulnerability-scanning like Qualys, antivirus tools like
Crowdstrike falcon, Symantec EDR, Ms Defender, etc.

AppSecurity Tailsman, Kubesec, OPA Conftest, Trivy, etc

Systems: Experience working in mixed Windows/Linux, database, and virtualized/physical

server environments.
Programming: Shell scripting, groovy script, manifest file, helm chart, ansible playbooks,
Terraform state file, etc.
Firewalls Palo Alto FWs, Panorama.
Cloud AWS, Azure
DevOps CI/CD, Terraform, Jenkins, Ansible, Kubernetes, Docker, Artifactory- Nexus, Build
Tool-Maven. SCM- Github, versioning -Git, code analysis-SonarQube,
CloudFormation, Elastic LB, Lamda, EKS, ECS, EFS, Kops etc.

AWS
Monitoring CloudWatch, CloudTrail, Promethus and Grafana.
Tools
PROFESSIONAL EXPERIENCE

L.A. Care Health Plan

DevSecOps Engineer. 2022 to
present.
Automate and integrate security processes and controls for customers, from SCM to CI/CD pipelines to
production deployments.
Write and modify manifest files for kubernetes, jenkinsfile for Jenkins, and terraform state files.
Conducts threat modeling early in the SDLC cycle.
Conduct infrastructure security assessments for customers to identify loopholes in their cloud security posture
and provided effective remediation strategies to tackle discovered security risks.
Implement and fine-tuned application security tools such as SAST and DAST with developer user experience in
mind
Perform formal review, implementation, testing and optimization of monitoring solutions such as new relic,
promethus and grafana for clients to highlight the value of infrastructure, availability, APM and security
monitoring within their SDLC.
Mentor team members around Cyber threat intelligence, security awareness and security engineering best
practices.
Reviews and updates the Security Framework for the entire Pipeline, adding commit signings with GPG keys,
pre commit hooks with Talisman, OPA Conftest for container base image scanning.

L.A. Care Health Plan 2017-2022

DevOps Engineer.

Responsible for application build & release process which includes Code Compilation, Packaging, Security code
quality scanning, Deployment Methodology and Application Configurations.
Configure Jenkins jobs and pipelines using Git, Maven, SonarQube, Verracode, nexus artifactory.
Defining release process & policy for projects early in SDLC and responsible for source code build, analysis and
deploy configuration.
Extensively worked on Jenkins for continuous integration and for End-to-End automation for all build and
deployments. Implement CI-CD tools Upgrade, Plugin Management, Backup and Restore.
Created pipelines from the scratch and wrote Jenkins file using Groovy scripts.
Set up Kubernetes (k8s) Clusters for running microservices and pushed microservices into production with
Kubernetes backed Infrastructure. Development of automation of Kubernetes clusters via playbooks in
Ansible.
Use Kubernetes to deploy scale, load balance, scale and manage Docker containers with multiple namespace
versions.
Use SonarQube for code quality review that yields speedier deployments and cleaner code.
Automate build and deployment using Jenkins, Docker and Kubernetes to reduce human error and speed up
production processes.

SOUTHERN CALIFORNIA EDISON 2016 to 2017

Network Security Engineer

Monitoring/Incident Handling
  Monitored the security of critical systems and SIEM infrastructure (e.g. Web applications, database
servers, email servers, etc.) to ensure appropriate incidence response in line with administrative
policies.
 Conducted network vulnerability scanning using tools like Qualys and Crowdstrike falcon to evaluate
attack vectors, identify system vulnerabilities and develop remediation plans and security programs.
 Conducted routine social engineering tests and clean-desk audits to determine efficiency and
optimization of the system and identify and mitigate security violations.
 Investigated potential or actual security violations or incidents to identify issues and areas that require
updated security measures or policy changes, driving it to the end in line with incident
handling/response methodologies.
 Monitored and reviewed alerts on Splunk ES, Palo Alto FWs, and Cisco Stealth watch, categorize alerts,
and take actionable remediation steps.
 Saved the organization thousands of dollars by containing and diffusing a security incident/breech.

Vulnerability Scanning and Management

 Performed periodic network, endpoint, hosts vulnerability scans and compare results with the central
database, using tools like Tripwire’s IP360, OpenVAS, and Qualys, Crowd strike, Nessus, etc.
 Deployed weekly patches to various operating systems in the cooperate network.
 Participated in weekly team 24/7 schedule to support 24/7 needs of the department.
 Tier 2 troubleshooting of cisco routers and switches.
 Reset and configured two factor authentications for users on RSA token dashboard.
 Onboarding and offboarding of users on active directory.
 Resolved security incidents following ITIL standards.

Strategy Development
 Researched new developments in IT security to recommend, develop, and implement new security
policies, standards, procedures in line with the company’s policies and security standards.
 Coordinated with third parties, Vendors, to perform vulnerability tests and create security
authorization agreements and standards.

Secured Retail Networks 2014 to 2016

Security Analyst
Provided insight on security controls applicable to rapid software development methodologies and
automation.

• Spread awareness and knowledge of good Information Security practices in development teams.

• Collaborated with multiple departments across the organization to conduct 3rd Party cybersecurity risk
assessments before onboarding vendors.

• Automated the deployment of security solutions as required to effectively detect, analyze, contain, and
eradicate security incidents while collaborating with key stakeholders (Network admin, Devops engineer,
developer etc.) and other members of the security team.
• Developed and maintained system security plans, information security policies, procedures, and guidelines.
• Performed security compliance checks and vulnerability assessments on our client’s infrastructure using
Qualys.
• Participated in security risk assessments and recommend mitigations and countermeasures to address risks,
vulnerabilities, and threats to our client’s enterprise infrastructure.
• Performed formal security reviews of application designs and deployments as required, covering web
application, APIs, mobile applications, and networks.

Advanced MP Technology May 2012 to August 2014

Network Engineer
 Functioned as tier I/II support engineer.
 Installed, configured, and maintained hardware, software, and server operating systems.
 Maintained and programmed company’s CCTV management system for 24/7 live view via the CMS
software.
 Resolved tickets as they come in through the help-desk ticketing system. (Zendesk, ladesk, clarity soft,
Jira, etc.),
 Remote support of 700 + end-users mostly using team viewer, web ex, zoom remote software.
 Resolved printers, LAN/WAN, and wireless connectivity issues.
 Point-to-point and multipoint configuration of sites using various layer 2 technologies like VPN, MPLS,
etc.; and layer 3 routing protocols like BGP, OSPF, EIGRP, etc.
 Conducted server maintenance, backups, and restoration.
 Provisioned and De-provisioned laptops, Macs, servers. Basically, the onboarding process for new
employees.
 Creating VMs on EsXi for Azure, users and for remote training.
 Firewalls and VPN troubleshooting and configuration. (SonicWall and Cisco).

EDUCATION AND CERTIFICATIONS

Western Governor’s University, Utah.

Master of Science in Information Assurance and Cybersecurity
Thesis: The Importance of information security in payday Industries.

Enugu State University of Science and Technology.

Bachelor of Science in Computer science.

Certifications
 CISSP – Certified Information Systems
Security Professional.
 CCNP – Cisco Certified Network Professional
 AWS-CSA – AWS Solutions Architect-
Associate
 CEH – Certified Ethical Hacker
NSE 4 – Network Security Expert (Fortinet)