Like many of his industry peers, Jeff Sass lightheartedly credits two wacky brothers, Mario and Luigi, with opening his eyes to the wonders of technology. Video gaming was the start of what would eventually lead to Jeff's decades-long career at Adobe, a multinational software company recognized for Creative Cloud, Document Cloud, and Experience Cloud.
Jeff is a senior engineering manager working on Adobe's Photoshop team. He is also the PSIRT (Product Security and Incident Response Team) liaison and Security Champion for Adobe Photoshop. One of his primary roles is to help ensure that all Photoshop products are secure. Jeff works with ASSET (Adobe Secure Software Engineering Team) to help make certain that reported vulnerabilities are resolved within their specified disclosure date. He also leads the Photoshop team's efforts around static code analysis and code quality.
Jeff holds three graduate certificates from the SANS Technology Institute. Here, he talks to us about his experience with the SANS.edu program and offers advice to those considering a similar path.
Q. Prior to attending the SANS Technology Institute, what was your educational background?
A. I have a Bachelor's Degree in Computer Science from Drake University and a Master's Degree in Computer Science from Washington University in St. Louis. Coming out of graduate school, my focus areas were computer networking and computer graphics. I was hired by Adobe as a quality engineer and I've spent my entire career at Adobe in various roles. I've worked on desktop products, server products, and most recently, mobile products.
Q. Why did you choose to enroll in one of the SANS Technology Institute's graduate certificate program?
A. While I possess both a graduate and undergraduate degree in computer science, there was a gap in my education. I went to college in the mid-to-late 90s, back when computers were connected to the internet with 56K modems and a decade or so before the proliferation of the information security industry. When I was in school there were few courses on cybersecurity. I knew at some point I would need to expand my technical skills to include security. However, I wasn't ready to dive in until 2011 when I earned Adobe's Security Brown Belt. I completed a project for Adobe LiveCycle that involved implementing cross site scripting protection and ensuring the entire organization completed security training. I did not want to invest in an additional 36 credits for a second master's degree. The SANS Technology Institute's graduate certificate program offered a short, technically-focused curriculum. I could get exactly what I needed from SANS.edu.
Q. From your research how did SANS.edu differ from other graduate certificate programs?
A. I found that many graduate certificate programs were offering content that was outdated or teaching techniques that didn't scale to large organizations. Conversely, SANS.edu's course material is constantly updated, and delivered by best-in-breed instructors who are experts in their field. For example, I had a SANS instructor who is industry-recognized as one of the top 10 experts in the world on penetration testing. Additionally, unlike other programs I researched, SANS.edu offered the flexibility of classes on-demand and/or at live events. I was working full time, so adhering to a strict classroom schedule was not feasible.
Q. What did you find most valuable about the program?
A. All the SANS Technology Institute classes deliver relevant real-world information complemented by hands-on labs. The opportunity to immediately transfer classroom knowledge to the workplace is invaluable. The Cybersecurity (Core) Graduate Certificate's capstone project included NetWars, a suite of hands-on interactive teaching scenarios that provided even more technical depth than the labs in each individual class.
Q. What did you expect of the program?
A. I expected the program to be challenging. However, I was surprised by the vast amount of material covered. It was extensive. And while sometimes overwhelming, always invaluable.
Q. How has your SANS.edu degree impacted your career trajectory?
A. My SANS experience has raised my visibility across the corporation, including the C-suite. I now work as a liaison with the company's broader security team. Prior to SANS.edu, I lacked the technical background needed to participate in these company-wide security meetings. Further, completing my graduate certificates and writing two GIAC-Gold papers has helped me achieve the ASSET Black Belt award at Adobe. According to Adobe's CSO Brad Arkin, when presenting me with my Black Belt, "Jeff can get a job anywhere doing security at any top-tier place... Your offer to join my team is in the mail." Since earning SANS Technology Institute graduate certifications, I have been promoted to senior engineering manager.
Q. What advice would you offer someone considering applying to the SANS Technology Institute?
A. You should have a hunger for learning. You must be disciplined. Make sure you have enough time to devote to the program. You will get out of SANS what you put into it. If you are unsure about making the commitment, you can try out the program by taking an individual class in an area of interest.
Q. What's next for Jeff Sass?
A. I love working at Adobe and believe that my future here is bright. As Adobe moves our imaging algorithms to the cloud, it will require an even larger focus on security. In 2021, I changed roles to Senior Engineering Manager of Product Security and Incident Response for all of Adobe. I am excited to focus on security full-time for the next phase of my career and SANS has helped me achieve that goal.