Paper Title Number 5, with math \(E=mc^2\)
Your Name, You. (2024). "Paper Title Number 3." GitHub Journal of Bugs. 1(3).
CV
WORK EXPERIENCE
- Security Engineer, Vulnerability Management • 10/2024 - Present
- GitLab • Pittsburgh, PA (Remote)
- Implement new and iterate on existing technology to help identify and mitigate security issues.
- Build automation.
- Validate and triage identified vulnerabilities.
- Track remediation efforts to their completion.
- Contribute to team strategy in managing threats and vulnerabilities.
- Participate in rapid action efforts or other emergency response as needed.
- Vulnerability Analyst / Member of Technical Staff • 10/2014 - 05/2023
- CERT/CC Division, Software Engineering Institute, Carnegie Mellon University • Pittsburgh, PA
- Vulnerability analysis and threat modeling: analysis of reports of potential software vulnerabilities from independent researchers, typically in open source software components – including identifying flaws using CWE, OWASP, etc.; assessing severity with CVSS, modeling threats with STRIDE, etc.; assigning CVEs; and coordinating vulnerability disclosure process with vendors using PGP and other tools; etc.
- Authored ~150 CERT Vulnerability Notes on software vulnerability disclosures, in coordination with researchers and product developers/vendors (see: https://www.kb.cert.org/vuls/)
- Co-author of The CERT Guide to Coordinated Vulnerability Disclosure (CERT/CC, 2017; see the original report, or the updated web version).
- Developed and maintained internal tools for vulnerability discovery and reverse engineering, including Kaiju extension for Ghidra in Java, and data analysis tools in Python for use in CERT Pharos
- Self-directed analysis and research and authored professional blog posts on topics in coordinated vulnerability disclosure, static code analysis, and Rust programming language & ecosystem security (see blog posts: https://insights.sei.cmu.edu/authors/garret-wassermann/)
- Represented CERT/CC on CVSS SIG and contributed to the development of CVSSv3.0 (see: https://www.first.org/cvss/v3.0/specification-document)
- Delivered presentations at conferences on coordinated vulnerability disclosure and software security
- Adjunct Instructor • 09/2011 - 10/2014
- Various Institutions (ITT Technical Institute, Pittsburgh Technical College, Point Park University) • Pittsburgh, PA
- Taught courses including programming (Java and C++), computer networking, Linux operating system, calculus, college algebra, physics, electronics; varied by semester/quarter, about 5 courses per semester/quarter.
- Instructor of Record / Teaching Assistant • 08/2009 - 08/2011
- University of New Orleans, Department of Physics • New Orleans, LA
- Taught general physics lab and lecture courses
- Co-authored new physics lab curriculum and laboratory manual (1st and 2nd semester, both algebra- and calculus-based)
- Developed simulations for quantum optics problems in Python
- Graduate School Project: Quantum density operator methods for three-level atoms
- Supervisor: Dr. Ashok Puri
- Research Fellow • 08/2007 - 08/2009
- University of New Orleans • New Orleans, LA
- Managed an experimental lab: producing samples; analysis using electron microscope, ellipsometer, etc.; maintaining deposition equipment; training new users in sample preparation
- Developed simulations for magnetism in Fortran
- Masters’ Project: Investigating perovskite thin films produced via pulsed laser deposition for superconductivity
- Supervisor: Dr. Leonard Spinu
EDUCATION
- M.S. Applied Mathematics • 2011
- University of New Orleans • New Orleans, LA
- Concentration in Engineering and Applied Sciences
- M.S. Physics • 2009
- University of New Orleans • New Orleans, LA
- Concentration in Materials Science
- B.S. Physics & B.S. Mathematics • 2007
- University of New Orleans • New Orleans, LA
- Dual degrees
CERTIFICATES
- Software Development Lifecycle (SDLC) [Link] • 2024
- University of Minnesota on Coursera
- Secure Software Design [Link] • 2024
- University of Colorado System on Coursera
- Python 3 Programming [Link] • 2024
- University of Michigan on Coursera
- Programming in Go [Link] • 2024
- University of California - Irvine on Coursera
- Secure Coding Practices (Java/C/C++) [Link] • 2024
- University of California - Davis on Coursera
- JavaScript Security [Link] • 2024
- InfoSec on Coursera
- OWASP Top 10 - 2021 List [Link] • 2024
- InfoSec on Coursera
- Linux+ [Link] • 2013
- CompTIA
- SUSE Certified Linux Professional [Link] • 2013
- SUSE
- Linux Professional Institute LPIC-1 [Link] • 2013
- Linux Professional Institute
- Security+ [Link] • 2012 (Expired 2015)
- CompTIA
SKILLS AND INTERESTS
- Programming Languages: Python, Go, Haskell, Rust, Java, C
- Operating Systems: Linux (SUSE prefered, Red Hat, Ubuntu), Windows
- Experience maintaining RPM packaging for OpenSUSE especially using OpenSUSE Build Service (OBS)
- Technical Writing
PUBLICATIONS
The CERT Guide to Coordinated Vulnerability Disclosure
Householder, Allen D.; Wassermann, Garret; Manion, Art; & King, Christopher. The CERT Guide to Coordinated Vulnerability Disclosure. Software Engineering Institute. 2017. https://insights.sei.cmu.edu/library/the-cert-guide-to-coordinated-vulnerability-disclosure-2/
2016 Emerging Technology Domains Risk Survey
King, Christopher; Klinedinst, Dan; Lewellen, Todd; & Wassermann, Garret. 2016 Emerging Technology Domains Risk Survey. Software Engineering Institute. 2016. https://insights.sei.cmu.edu/library/2016-emerging-technology-domains-risk-survey/
Lab Manual for (First/Second) Semester (Algebra/Calculus)-Based Physics
Patricia Robbert, Garret Wassermann, and Elaina Rodriguez. Lab Manual for (First/Second) Semester (Algebra/Calculus)-Based Physics, 4th Edition. XanEdu Inc. 2019.
Fabrication and Assembly Behavior of Square Microcapsules
F. Li, X. Badel, J. Linnros, G. Wasserman, S. L. Whittenburg, L. Spinu, J. B. Wiley. "Fabrication and Assembly Behavior of Square Microcapsules". Adv. Mater. 2006, 18, 270–274
CONFERENCES
What Every Developer Needs to Know About Coordinated Vulnerability Disclosure
Talk at Abstractions, Pittsburgh, PA
Mobile Security: Methods and Challenges During Development
Panel discussion at ACM SPLASH 2015 Mobile Development Lifecycle workshop (MobileDeLi '15), Pittsburgh, PA
HealthTech 2015 - Medical Device Security
Conference proceedings talk at HealthTech 2015, co-located with 24th USENIX Security Symposium, Washington, DC