Andy Werderman

About Andy Werderman

Skilled in both identifying vulnerabilities and writing code to fix them, I specialize in building reusable, secure processes that enable developers to safely deploy to production. Experienced in automating security processes including certificate lifecycle management, secrets management, and compliance benchmarking all while minimizing costs. Trusted to protect AWS infrastructure ensuring scalable, secure ecosystems. Equally comfortable working individually or as part of a team. Excellent communication skills with management/staff at all levels.

Experience

1. Platform Security Engineer Ii

   Equinox

   Apr 2023 — Present · NY, US

   Led the migration of the company SIEM to Elastic Security implementing secure log ingestion, tuning detection rules, and optimizing alerting to significantly improve threat visibility and incident response effectiveness.Led the initiative to bring the Security Operations Center (SOC) fully in-house owning day-to-day operations, team performance, and long-term roadmap.Designed and implemented centralized AWS access management using Identity Center, enabling federated access via Azure AD with SCIM provisioning and deprovisioning for 200+ users across 25+ AWS accounts.Built a cloud security auditing and reporting platform using Steampipe, leveraging Compliance-as-Code benchmarks to define internal security standards and produce prioritized findings across all AWS accounts.Automated container image vulnerability scanning in ECR, surfacing Critical and High findings directly in developer pull requests as part of the CI pipeline.Defined and enforced standards for build-time and runtime secrets management, preventing credential leakage in container images and CI workflows.Designed and deployed a centralized SonarQube environment, integrating SAST scanning into 500+ CI/CD pipelines using reusable, standardized modules.Modernized database access by automating RDS credential rotation, enabling IAM-based short-lived credentials, and enforcing TLS for all connections.Owned PKI and certificate lifecycle management for cloud infrastructure using AWS Certificate Manager, Let’s Encrypt, and OpenSSL.Architected and implemented a multi-layer defense against credit card testing and BIN attacks, reducing fraudulent traffic by 99%.Designed a Bring Your Own Account (BYOA) model to securely enable GitHub Enterprise SSO and organization access.Partnered with application teams to implement HMAC authorization and Auth0-based OAuth for public-facing APIs.

Education

• University of Oregon

  Bachelor of Science - BS, Mathematics and Computer Science

  2013 — 2018