Milton Smith

Leadership Highlights

• Led Oracle’s shift to open public communication on Java security, which until then had been limited to Critical Patch Update notices. Won agreement from Legal, PR and executives and became Oracle’s voice on Java security to customers, researchers, industry groups, analysts and governments.
• Accountable for Java platform security incident response and vulnerability response for an engineering organization of more than 650. Worked with outside researchers and coordinated triage. Dotted-line report to Oracle’s chief security officer.
• Met customers’ chief information security officers on multimillion-dollar Oracle purchases held up over Java security concerns, and helped close those deals.
• As Director, Product Security at NetSuite, rebuilt a department that had been left without a director. Organized it into architecture and consulting, engineering, and security testing and compliance. Promoted leaders from within. Ran the program to goals including time to respond and time to remediate. Accountable for incident response.
• Earlier: embedded security lead for Yahoo’s User Data Analytics (more than 80 billion transactions a day); built the global security engineering team at SuccessFactors; application security (AppSec) architect for ERCOT, operator of the Texas power grid.

Oracle Java role: I inherited one of the industry’s most difficult security incidents only 14 days after joining Oracle from Yahoo. It was rough on the team, and not an experience I’d wish to repeat. On the positive side, it built character, gave me the chance to do things I would not otherwise have done, and introduced me to some of the brightest minds in the industry.

Career Highlights

• Director, Product Security — Oracle (NetSuite)
  Led the global product security team, reporting to the department vice president: about 25 security staff in the U.S., Canada, Czech Republic, Uruguay, U.K. and Spain through four senior-manager direct reports. Restructured the department and promoted from within. Accountable for incident response and gave executives impact and risk assessments. Coordinated technical assessments for compliance certifications and directed engineers building internal security tooling.
• Senior Principal Product Security Manager, Java — Oracle
  Security lead for the Java platform (Java SE, JavaFX, Java Embedded, Java Card) through the 2012–2013 crisis. Acted as the Java business unit’s information security officer (BISO), with a dotted-line report to Oracle’s chief security officer. Set the platform’s security vision, influenced security features and remediation priorities, and coordinated with browser makers such as Mozilla.
• Principal Software Engineer, Application Security — Yahoo
  Member of Yahoo’s security team (the Paranoids) and embedded security lead for User Data Analytics (more than 80 billion transactions a day). Led the enterprise security triage program for all Yahoo properties.

For full details, request my resume.

Also — United States Marine Corps veteran (Communications)  ·  Computer science coursework, University of Southern Maine  ·  SANS Institute training

Selected Press

The press wasn’t always kind, and that was to be expected. Part of the answer was communicating the Java engineering teams’ security progress in a way that Legal, PR and Oracle executives could support. I proposed a security track at JavaOne and used it to publish Java remediation rates and vulnerability categories.

In 2013 my work and public statements were covered by The Register, InfoWorld, Computerworld, InfoQ, PC Magazine and the San Jose Mercury News, much of it following the January 2013 Java User Group Leaders Call.

Conferences & Presentations

JavaOne Security Track — Founder and Chair — 2013, 2014, 2015, 2016, 2017 (five conferences). I used the track to publish Java remediation rates and vulnerability categories.

Publications & Media

Past Projects