John Duffy

Background

About John Duffy

Experienced senior leader working at the intersection of product development and security. I help management teams meet their performance targets by understanding and managing risk. I’m the first-call when people need the answer to “what do we do about Security?” This involves facilitating and driving the situation assessment, strategy, implementation and operational aspects of security within the business. A key component is an agile and flexible approach to risk and compliance - Security isn’t about saying “No” - it must work to enable frequent change in an organization. I emphasize a practical approach to risk management driven by a deep technical understanding, seeking-to-understand collaboration and an iterative, continuous-improvement approach that emphasizes delivery. I like to position Security as a first-class feature, engaging clients by highlighting its value and keeping them informed on their investment. With over 20 years of experience, I’m responsible for the security program that protects 200M+ identities and systems with millions of daily public/private users located across 80 countries in high-security environments. If you have a passport, made an Interac purchase, been to a hospital or bought a lottery ticket you’ve probably relied on my work. I’ve also had the privilege of speaking at large conferences and events including OWASP, BSides and ATLSecCon along with being recognized by OCIPEP for outstanding research in security. My career has ranged from leading security for a muti-national organization that is a leader in the secure citizen-identity and high-security banknote space to small startups, and been responsible for: Security Architecture (Cryptography, IAM, Secure Design, AppSec), Compliance (SOC2, PCI, ISO, NIST 800-53, GoC/CISD) Assessments (TRAs, PIAs, Supply Chain Risk, Penetration Testing, Social Engineering) Governance (Exec Mgmt Review, KPI Setting, Strategy, Policy) Security Operations (SIEMs, Vulnerability Management, DevSecOps, Incident Response) Training (Secure Design/OWASP Top 10/Operational Courses and Portals) My background also includes leading Product teams that successfully introduced new technology after years of R&D into critical infrastructure: First issued high-security ePassport, First issued Drivers Licence with printed digital signature and First general-public Mobile Drivers License.