ITILv3 Foundation Certification

Black Hat - Rootkit class 1st and 2nd generation

ISC2 - CISSP

Black Hat - Understanding Stealth Malware

SCRUM - Certified SCRUM Master

Syddansk Universitet - University of Southern Denmark

Principal Security Architect at Qlik

Copenhagen, Capital Region, Denmark

I'm being responsible for Threat Modeling and Security Architecture at Qlik as well as provide industry best practices and patterns for putting security at the right level for big data and large enterprise customers.

I'm also a member of the Architecture Council to enhance Security focus/impact and reviews.

Cloud security and Mobile security being two main focus areas.

Qlik

Principle Security Architect

- Global lead and responsible for Security Engineering within Sony Mobile.
-   Threat Modeling: Create threat models to systematically find threats and security requirements based on threat and impact levels.
-   Incident management: Evaluating, risk assessing and handling incidents in a controlled and streamlined fashion.
-   Privacy: Privacy is an increasing concern all over, and especially in mobile devices that can host a lot of PII (Private Identifiable Information). Especially regarding GDPR, this is becoming much more important. So I help out with Privacy Impact Assessments, and make sure PII is protected in transit and at rest.
-   Cloud Security: Helping architects and service development with getting security right in cloud environments.
-   Mobile Security: Providing internal advice and expert security skills to make security decisions in features and products.
-   SDL: Ensure Security is integrated into the Software Development Lifecycle, and provide training about Mobile Security.
-  iOS and MacOS competence center. I (together with a close colleague) has created an iOS and MacOS competence center within Sony Group, regarding security, deployment and signing of iOS and MacOS apps.

Sony Mobile Communications

Master Security Specialist

- Responsible for Enterprise Security Architecture, making sure a range of security areas from network security to application security over is well designed and fitting into the general enterprise architecture.
-  Making sure projects follow a SDL, and assisting with threat modeling.
-  IAM solution design, assisting projects in integrating correctly with both our proprietary and COTS IAM solutions.
-  ERP solutions and <a href="http://Salesforce.com">Salesforce.com</a> integration, designing and architecting the security around both integrations points and external access.
-  Two factor authentication solution and architecture, deciding the right level of security for the right projects, and making sure business know all the pro and cons to different solutions along with total cost.
-  Database security design, ensuring the right level of security is applied to the right data, and access is properly controlled and audited.
-  Security risk analysis and recommendations. Assisting operational security with expert knowledge of risks and vulnerability management.
-  3rd party security requirements. Defining security requirements when a project needs a 3rd party solution or RFI's are put together.
-  Development of Secure programming courses, as part of the SDL, to make make developers and testers aware of security risks and mitigation factors.
-  Cerate Secure coding guidelines as a foundation for part of the SDL.
-  Secure Software development lifecycles and processes
-  Secure Application Development Frameworks, making sure the right frameworks are utilized in the right way across the enterprise.
-  Giving input to projects about Cloud security and virtualization secuirty to ensure risks and costs are understood.
-  Scrum and agile development. As a certified scrum master assisting development teams with integrating security.
-  SAP Security


-  - Speaker about Mobile Security as well as Cloud Security at many international big conferences. Most often also part of the panel for panel discussions.

Maersk Line

Senior Security Specialist / General Manager

- Advanced Penetration Testing for 100+ customers Web sites and infrastructure.
-  Application security testing of Web Apps, ActiveX, Java and thick Windows applications, finding security flaws, both technical and logical flaws.
-  Doing many Mobile Security assessments – including Mobile Web banking, assessing everything from over the air traffic to end-point security of the devices.
-  White hacking including social engineering and alternative ways to gain access to information.
-  Reversing and Malware Analysis when customers had an incident or wanted to access the security of a 3rd party component or application.
-  Teaching Secure Coding Courses for developers and testers at some of the big insurance companies and banks in Denmark.
-  Conducting Code Security Reviews for a high profile national security project.
-  Helping customers to implement a proper Secure Software Development Lifecycle, and getting the elements prioritized and put in place in the organization.
-  IT Security Research, to stay up to date with the extremely fast moving security world.
-  Software development using C++, Java and C#, assisting developers with code or creating POC.
-  Creating mobile apps for IOS and Android.
-  Help with Secure Software development lifecycle and process adoption.
-  Successful integration of Secure Application Development Frameworks.
-  PCI-DSS compliance and testing. Making sure customers got guidance and assistance in complying with PCI-DSS as well as local regulations
-  Assisting with compliance for customers and ensuring maintained PCI ASV status.
-  Testing and helping improving security of the big gambling companies.

-  Testing and helping improving security of the national Danish Bank (Danmarks Nationalbank), along with other major banks.

-  Working with some of the largest insurance companies in Denmark in terms of information security, ranging from security architecture to secure software development and penetration testing.

nSense Denmark A/S (Ezenta split)

Principal Security Consultant

- Advanced Penetration Testing for many Danish and international customer's Web sites and infrastructure.
-  Application security testing of Web Apps, ActiveX, Java and thick Windows applications, finding security flaws, both technical and logical flaws.
-  Doing many Mobile Security assessments – including Mobile Web banking, assessing everything from over the air traffic to endpoint security of the devices.
-  White hacking including social engineering and alternative ways to gain access to information.
-  Reversing and Malware Analysis when customers had an incident or wanted to access the security of a 3rd party component or application.
-  Teaching Secure Coding Courses for developers and testers at some of the big insurance companies and banks in Denmark.
-  Conducting Code Security Reviews for high profile national projects.
-  Helping customers to implement a proper Secure Software Development Lifecycle, and getting the elements prioritized and put in place in the organization.
-  Security Architecture and Design consultancy for customers who worried about security across the enterprise or across multiple development teams or departments.
-  IT Security Research, to stay up to date with the extremely fast moving security world, and brooding my professional network, plus find new vulnerabilities when doing security assessments.
-  Software development using C++, Java and C#, assisting developers with code or creating POC. Assisting with developing a security vulnerability scanner.
-  Creating mobile apps for IOS and Android

Ezenta A/S (nSense)

Senior Security Consultant

Lead Security Architect/Engineer designing and evaluating security from network over programming to forensic. Malicious code analysis and Proof of concept exploits. Hardcore troubleshooting and development security designs.

-  Developed Secure programming courses with topics such as SQL Injection, Buffer overflows, best security guidelines, pwd mngt.
-  Penetration testing using many different tools from Nessus, MetaSploit and WebInspect to open source tools.
-  Architectural security design and input to development to have security part of development from the start/design phase.
-  Proof of concept code for various vulnerabilities to assess real risk in our environment.
-  Hard-core DCOM trouble shooting between trading systems.
-  Bug finding in Windows.
-  Password audits with LCP and rainbow tables.
-  Forensic and incident handling establishing what went on and was done during and prior to the incidents.
-  Cloud & Virtualization security
-  Salesforce CRM integration & security

Security audits and assessments in Saint Petersburg and Singapore offices. Educating developers in Secure software development in St.Petersburg, Russia.

Saxo Bank

Principal Security Engineer

Chief Information Security Officer
Responsible for technical IT Security, including infrastructure and software development security.
Provided guidelines and policies to the rest of the organization.
Validated designs and implementation from a security point ofview.
Acted as a internal consultant to IT (Systems and Software development) when Security help or advice was needed.
Designed and implemented a BlackBerry solution.
Designed and implemented a Citrix solution for secure remote access.
Provided security training to IT staff (operational and developers).
ERP architecture and solutions plus <a href="http://Salesforce.com">Salesforce.com</a> integration

CISO

Hired as Infrastructure Security specialist/consultant, but also worked with Development (C++ and .Net/C#), including Secure Programming.

-  C++ Gui for large Telco company, including database security design considerations and stored procedure.
-  Penetration testing of various companies.
-  DDNS customization through scripting for VPN clients in major Danish bank.
-  Introducing advanced <a href="http://C#/.NET">C#/.NET</a> and best practices for the Microsoft development group in HP-DK.
-  Security Architectural design input in numerous projects and proposals.
-  Windows Mobile (PocketPC) mobility solutions and security.
-  HP UX security including hardening installation for different customers.
-  HP Virtual Vault (secure HP UX version) research and experience.
-  Two Factor authentication designs and implementations.

Working on various big infrastructure security projects abroad.

Data Center Security design for major Indian Oil company.

Hewlett-Packard

Security Consultant

Chief Security Officer.
Responsible for Security at one of the biggest ISP in Denmark, designing and implementing infrastructure + security, including Microsoft & Linux servers.
-  Cisco PIX design and configuration
-  OpenBSD firewalls solution for small segments
-  Cisco Netflow IP accounting for network overview,
-  Hacking Forensics (both Windows and Linux servers)
-  WebServer and SQL hardening for web hotel web servers.
-  Secure coding/development for ASP and C++ solutions.

A/S ScanNet

Technical manager, responsible for internal development and security, plus customer related development and architecture.

-  Responsible for internal IT Security
-  Running Lotus Notes/Domino infrastructure
-  Developing custom Notes database and solutions
-  Teaching Security courses
-  C++ consulant for external developers

Target Gruppen

Chief Technical Officer

Teaching advanced programming and network design, as well as secure programming among other things.
Working on a variety of projects.
MCT (Microsoft Certified Trainer), teaching MOC courses (Visual Basic, Visual C++, COM and MS-SQL).
Developing custom courses about Code Security, Advanced C++ and DCOM.
Developing Software on contract basis (mainly in C++) for customers.

Instructor (MCT) & Developer

Designing and implementing custom applications, using Pascal, C and C++.
Unix and Windows security research and advisories.
Developing own Pascal compiler for a specific project.
Reversing and assembler projects on Windows and Solaris.
Xwindows security research and exploitation.
Campus Unix network security flaws identification and advisories.

Jorgen Hjort

Jorgen Hjort