Omkhar Arasaratnam

Guest Lecturer

2023

I am a guest lecturer for CS-GY 6903 Applied Cryptography

Capstone Mentor

2020

I am a capstone mentor for the MS Cybersecurity Risk and Strategy program https://cybersecurity-strategy-masters.nyu.edu/academics/cyber-experts-from-law-technology-and-business/

Center for Cybersecurity Senior Fellow

2018

Various advisory and research activities in conjunction with the NYU Center for Cybersecurity (CCS). Sponsor of the S&K Scholarship https://engineering.nyu.edu/academics/programs/industry-partner-programs/scholarship-programs https://engineering.nyu.edu/advisory-council/omkhar-arasaratnam http://cyber.nyu.edu/team-member/omkhar-arasaratnam/

General Manager, OpenSSF

2023 - 2024

Director of Engineering, Regulated Cloud Solutions

2020 - 2023

* Led the Regulated Cloud Solutions organization of ~100 software engineers and ~200 extended team members across the US, EU and India. * Delivered over 150 Assured Workloads products to general availability, unlocking over $200b in Total Addressable Market (TAM) globally across global public sector and sovereign customers. * Led the development of Sovereign Controls by Partners, including the onboarding of flagship partners T-Systems and S3NS, unlocking $280M in sales pipeline and 48% of EU revenue potential for Google Cloud * Helped develop go to market strategy for sovereign and regional expansion roadmaps in the EU, Middle East and Asia with an estimated TAM of $50b. * Collaborated with cross domain senior leaders across Google Cloud Engineering, Partner Engineering, Product Management, Technical Product Management, CISO, Public Policy and Legal to prioritize, engineer and deliver secure, compliant products. *Sole point of contact for technical leadership during negotiations with international regulators such as: ** US : the FedRAMP JAB for FedRAMP High compliance, DISA and the NSA for DoD IL4 and DoD IL5 compliance, Google Export Counsel for ITAR ** Italy : ACN for PSN compliance ** KSA : CCRFv3 compliance * Executive sponsor for several Regulated Cloud customers, such as Palo Alto Networks and S3NS. In this capacity I prioritized key “P0” features for our most important clients, and acted as an executive point of escalation.

Director of Data Management and Protection Technology

2018 - 2020

* Established technical direction and engineering of JPMC’s inhouse next generation data protection technology : Data Trust. *Data Trust was used in critical customer facing applications, such as Online Credit Card Dispute resolution, protecting the data of over 150 million Chase Credit Card customers. * Built a team of more than 100 software engineers, site reliability engineers and infrastructure engineers across the US, Argentina, Singapore and India that built and operated Data Trust as well as JPMC cryptographic infrastructure (HSMs, KMS etc) * Managed a budget of $30M annual run rate, including OPEX, CAPEX and labor to deliver Data Trust and cryptographic infrastructure. * Built integrated roadmaps for Data Protection with industry partners such as Ionic, Microsoft, Amazon and Google to support JPMC’s cloud strategy. * Established industry partnerships with other large financial sector organizations from FS-ISAC (Financial Sector Information Sharing and Analysis Center) and FSARC (Financial Systemic Analysis and Resilience Center) to ensure adoption of standards compliant rulesets and protection schemas across organizations.

Global Head Cyber Security and Americas Regional Head TSS, Credit Suisse

2016 - 2018

* Served as Global Head of Product Management and Engineering for Cyber Security, and created the Cybersecurity Product Management, Engineering, Secure System Development Life Cycle (SSDLC) and Security Analytics functions. * Technology Security Services Executive for Credit Suisse Consolidated US Operations (CUSO) and Americas region, and the Americas Technology Executive for security related interactions/inspections with regulators including DFS, SEC, FRBNY, OCC, FINMA, MAS and HKMA. * Led the resolution of numerous Matters Requiring Attention (MRAs) and Matters Requiring Immediate Attention (MRIA) with US regulators. * Managed a team of 40 software engineers, infrastructure engineers and product managers across New York, Raleigh and Zurich. * Successfully delivered 10m CHF of Change the Bank (CtB) project portfolio and continuous improvement annually as part of improving Credit Suisse’ cybersecurity infrastructure. * Created a risk based financial planning model to prioritize CtB investments against top information security risks for optimal risk management * Managed 25m CHF of Run the Bank (RtB) labor, OPEX and CAPEX covering all of Credit Suisse’s cybersecurity operations globally. * Led global transformation of TSS, Chief Information Security Office (CISO), Technology Operational Risk and Audit to align with Three Lines of Defense (3LoD) model. * Created the Risk and Control Framework; created governance and metrics to accurately measure operational cyber risk. * Created the Raleigh Cyber Engineering and Security Analytics delivery center with an initial team of 20 engineers.

CTO of CISO and Global Head of CISO Cyber Security Strategy, Architecture and Engineering

2014 - 2016

• Re-established the Security Architecture Board as a 2LoD governance board. • Rebuilt the Security Architecture team, providing security support to major projects. • Established the Security Solution Architecture team, providing solution architecture support to CISO Cyber Security projects. • Realigned CISO Cyber Security projects to adhere to SDLC principles, deliverables and methods to improve delivery and quality. • Appointed as the Chief Technology Officer (CTO) for CISO, member of the CTO Council. • Led innovation through partnering with universities, VCs and startups to incubate and improve new security technologies. • Led Security Engineering in an interim capacity from May 2015

Chief Security Architect

2012 - 2014

• Led the Enterprise Security Architecture team at the bank. • Provided strategic security architecture decision support for the bank. • Led development of the Security Reference Architecture Model (SRAM) – An enterprise architecture designed to support the risk posture of the bank. • Developed a management and continuous improvement system to govern usage and quality of SRAM assets. • Provided security architecture guidance for key projects at the bank, such as: o Payment Card Industry (PCI) o Data Loss Prevention (DLP) o Security Information and Event Management (SIEM) o Fraud Analytics o Cyber Security o Mobile Wallet • Adviser on key information security topics to senior executive management. • Governed security within the architectural community at the bank, ensuring alignment with security and architecture principles for all projects. • Spoken at numerous conferences regarding Risk Management, Security Architecture and Cloud Computing.

Industry Architect - Pensions, General Business Enterprise

2012 - 2012

Responsible for bringing cross IBM (Software, Hardware, Services, Research) capabilities to address business challenges within the pension industry - covering both plan administration and investment.

Global Chief Security Architect, SmartCloud Enterprise+

2011 - 2012

• Led the overall security architecture for the design, development and deployment of IBM’s SmartCloud Enterprise+ (SCE+), a managed Infrastructure as a Service offering. • Led development of the security architecture, principles, policies, procedures and standards used globally for SCE+ • Led ground breaking work in the application of SCE+ to IBM’s Deep Analytics engine (Watson) • Coordinated multiple global development work streams from IBM Research, Software, Hardware and Services divisions to provide a secure enterprise grade Cloud offering • Co-led projects jointly with IBM Research regarding Cloud security • Responsible for overall compliance and risk posture with SCE+, including external regulatory compliance (PCI, HIPAA, SSAE16) • IBM Global lead for contributions to ISO/IEC Sub-committee 38 Working Group on Cloud computing • IBM Global lead for contributions to ISO/IEC Sub-committee 27 Working Group on Cloud computing security and ISO/IEC 27001:2013 refresh

Lead Senior IT Security Architect

2009 - 2011

• Thought leader, architect and trusted advisor to CIO, CTO and CISO regarding information security and risk management • Led an organization of presales architects and security delivery personnel for Canadian security services • Had profit and loss responsibilities for business development and delivery of security services in IBM Canada • Led architecture and development of the largest security deals in Canada, including Government of Alberta ($19m) and Project Phoenix ($30m) • Canadian Cloud security thought leader, presented at several conferences, universities and customer briefings • Developed cloud security assessments and training for IBM worldwide • Lead security architect for multi-million dollar complex security opportunities involving multiple business units across IBM. • IBM Architecture (Team Solution Design) method advocate for IBM Security Service in Canada • Canadian lead for Smart Grid security

Lead Enterprise Architect, Component Infrastructure Roadmap

2007 - 2009

• Performed infrastructure assessments and roadmap planning aligned to client strategic business needs using CIR (Component Infrastructure Roadmap) technique. • Developed solution architectures which assisted IBM clients with realizing business goals through use of IBM products and services • Led organizational change management and adoption of strategic roadmaps • Created IT Service Management improvement plan for a Large US Financial Institution, projected to reduce operational expense by 35% over 5 years • Lead a $20 million dual data center / IT Service Management improvement project with Large US Retailer • Assisted a large US Energy and Utility company with converging Operations Technology and Information Technology objectives into a 5-year Smart Grid convergence plan. • Acted as Security subject matter expert for CIR content • Lead incubator team at the Open Group regarding Cloud security • Developed Cloud adoption model content for CIR method • Assisted with development and maintenance of the CIR materials and tools

Security & Privacy Architect

2004 - 2007

• Acted as Chief Information Security Officer for key government and financial clients • Developed Security Program Offices for several financial and government clients • Assisted several clients with regulatory compliance projects (Sarbanes Oxley, Bill 198) • Developed and augmented policies, procedures and standards for clients based on ISO 17799-2005 and ISO 27001 • Created Enterprise Security Architecture for several key clients • Member of the Open Group SOA Security Architecture working group • Canadian lead for IBM’s Data Centric Security Architecture initiative • IBM Enterprise Security Architecture working group leader • Developed solution architectures to meet client security needs • Performed security compliance reviews for various operating systems • Conducted forensics investigations. • Performed security related code review. • Lead Ethical Hacking team from 2005-2006, generating over $1 million in revenue across Canada and the Caribbean • Performed ethical hacking / penetration testing for numerous customers

Team Lead, Intel Server Services

2004 - 2004

• Contributed to IBM global internal security standards for Linux Acted as Linux Architect for several large account customers. • Conducted coaching sessions and root cause analysis when service outages occurred. • Actively participated in process improvement exercises to ensure optimal team performance. • Lead study of patch automation tools, which reduced security workload by 60% across the business unit. • Reduced server build time by 30% using unattended build process for Windows. • Architected server consolidation plan, reducing 32 Intel servers to two pSeries. Saved over 73% in operating costs. • Architected and implemented the first Linux/Oracle RAC cluster in Canada.

Windows and Linux System Administrator

2002 - 2003

• Performed System Administration duties for Intel based servers supporting internal and IGS Canada customers. • Served as Linux technical lead for service delivery center. • Worked with Account teams to migrate outsourced legacy Windows servers to Linux. • Successfully maintained Internal Security compliance for over 30 Linux servers. • Lead successful migration of all servers from Red Hat consumer distribution to Red Hat Enterprise Linux in a timely manner. • Developed web based on call paging system. Implemented using PHP and MySQL. • Developed KickStart based deployment method for new Linux server builds, reducing build time by 50%. • Mentored team members with Linux skill building. • Facilitated vulnerability scanning for all servers maintained by department. • Contributed to Internal Linux Security standards. • Assisted account team with VMware consolidation project. • Served as technical lead for Blade Center deployment.

US Mobiles Technical Support

1998 - 2002

• Provided second level and supervisory support for technical support call center. • Coached and mentored agents to improve customer satisfaction metrics. • Addressed customer escalations.