Chad Walker

Experience: Currently leading the Portfolio Information Security Office, comprised of a large team of information security consultants providing security requirements for new business applications and information security analysts performing continuous assessments of our most critical assets.

2023 : Present

Albertsons Companies

Senior Director, Head of the Portfolio Information Security Office

The PISO role is a cybersecurity consultant and liaison that works with business units to ensure they build and operate securely, while also ensuring that the security team is keeping pace with and meeting the needs of the business. In this role, I led a team of PISOs consulting for the Retail, Supply Chain, and Payment portfolios of Albertsons Companies.

2021 :

Albertsons Companies

Director, Portfolio Information Security Office

• Responsible for the overall security and compliance posture of Target’s point of sales systems, payment authorization gateway, and mobile phone activation services. Prior to this current domain of responsibility, I was accountable for the security posture of all new and legacy automation technologies in Target’s 36+ distribution centers.

• Met regularly with the business and engineering leadership of my portfolio to assess their overall risk posture, helped prioritize the remediation (or risk acceptance) of findings, and was their voice of the customer in regards to their interactions with the larger security organization.

• Reviewed and approved the conceptual architecture of new applications and business processes to ensure designs accounted for compliance obligations, the cybersecurity threat landscape, and larger IT organization efforts towards standardization, modernization, and repeatable patterns.

• Bridged the gap between technical and non-technical audiences to translate IT risk into business risk and served as subject matter expert and communications conduit between diverse security teams including security testing, threat intelligence, and incident response.

• Utilized creative thinking and threat modeling to develop security patterns for new and unusual architectures (e.g. reconciling 20+ year old legacy automation and bleeding-edge robotics working in the same environment, upgrading the development practices of start-up firm acquisitions to meet the needs of large enterprise customer, etc.).

2017 : 2021

Target

Lead Analyst, Business Information Security Office

• Was sole blue team security analyst on the Security Operations team, but also wore the hats of security consultant for projects, company-wide secure coding trainer, and subject matter expert / voice-of-the-customer for product teams.

• Reviewed and triaged security events coming from diverse sources (e.g. IDS, firewalls, DLP tools, email security tools, end-user questions, etc.).

• Hunted for malicious activity that wouldn’t create security alerts by testing hypotheses, creating custom snares, and running queries for known IOCs.

• Provided security requirements, risk identification, and architectural considerations for new business initiatives and data exchanges with 3rd party organizations.

2016 : 2017

Code42

Senior Security Analyst

• Developed the team’s Covert Research function from the ground up, which involved building and managing personas to interact with stolen data markets, with an eye towards operations security and technical tradecraft.

• Used the logs of numerous security controls (e.g. DNS, firewalls, IDS, anti-virus, whitelisting, DLP, and other endpoint and network products) to hunt for anomalous network and application behavior.

• Served as a SME and the next tier of support/escalation for the organization's incident response team and facilitated some internal huddles, briefs, and training talks within the larger blue team.

• Developed and maintained some of the team's non-traditional and sometimes exotic means of detecting anomalous network behavior, application behavior, and business-logic abuse.

• Broke a noteworthy POS malware campaign and worked directly with FBI on identifying this campaign’s victims and taking down its infrastructure.

• Used statistics and geolocation data to predict with veracity which companies were the victim of major new card dumps in stolen data markets, smashing our internally-set OKR of 6 months before the news media talks about it.

• Leveraged relationships with threat actors and insights from criminal forums to disrupt e-commerce and credit card fraud, in one case reclaiming $150,000 worth of merchandise.

• Worked with BestBuy.com engineers to make the site resilient against account compromise attacks, and then measured our success by watching BestBuy accounts slowly disappear from stolen data markets.

2014 : 2016

Best Buy

Cyber Threat Hunter

Company: Albertsons Companies