Michael Howard
The Microsoft security engineer whose book landed on every Windows developer's desk when the company stopped work in 2002 to learn how to write secure code.
Writing Secure Code (2001, with David LeBlanc) was a field manual rather than a theory text: buffer overruns, canonicalisation bugs, least privilege and threat modelling, all with concrete examples. When Bill Gates declared Trustworthy Computing in January 2002 and Windows development paused for a security push, the second edition was handed out widely, and Gates himself called it required reading at Microsoft.
With Steve Lipner he then codified the experience in The Security Development Lifecycle (2006), and with LeBlanc and John Viega wrote 19 Deadly Sins of Software Security. Among the more hands-on legacies is the SDL list of banned C functions such as strcpy — killing a whole bug class by letting the compiler say no.