Reddit, Inc.

Leading Reddit's software security team which focuses on AppSec, ProdSec, and a secure by default developer experience.

Head of Software Security

I'm designing and implementing security systems into all facets of Reddit's business. Protecting our company's employees and our website's users is my team's main focus.

Principal Security Architect

Aviso Ventures

Limited Partner

Bank of America

A senior security leader responsible for a large team, focused on Infrastructure Security Testing.
Responsibilities have included:

Management of our Vulnerability Scanning program continuously scanning millions of endpoints and thousands of web applications,
Enterprise Remediation Governance - partnering with our infrastructure owners to remediate vulnerabilities within given SLAs,
Management of our baseline compliance monitoring program, and
Management of our Internet Hygiene and perimeter analysis.

Previously led our cloud, container, and DevOps security programs for a hybrid, multi-cloud architecture.

SVP, Sr Security Manager, Cyber Security Defense

If it's a Cloud, Containerization, or DevOps initiative it's on my desk.

My job to work with all security control owners to operationalize their control in all major public cloud providers and Kubernetes or OpenShift environments.

SVP, Cyber Security Technology - Cloud Security Architect

Liquidmatrix Security Digest

- Write articles about current events in the security world and my personal take on them.
- Host a weekly podcast about current events in the security industry.

Writer & Podcast Co-Host

Goldman Sachs

- One of 3 CISOs of consumer facing divisions at Goldman. (Honest Dollar, Marcus, and GS Bank)

Vice President

Honest Dollar

Acting CISO, built an Information Security program from the ground up at a Financial Tech startup.
- Build secure SDLC, testing, and monitoring around a FinTech application running in Google Cloud on Kubernetes hosting a ReactJS, Go, iOS/Android application and backend financial connections.
- Manage creation and maintenance of policies
- Prove secure foundations during acquisition due diligence by Goldman Sachs

Head of Security [ Acquired by Goldman Sachs NYSE: GS ]

WhiteHat Security

Transitioned out of people management for my last stint at WhiteHat and really focused on industry leadership, sales enablement, content creation, partnership building, and new product launches.

This includes but is not limited to:
- Remediation Assistance & Guidance
- Secure Development Training
- Risk Based Vulnerability Prioritization
- SDLC Architecture Review
- AppSec Program Building
- Asset Discovery

Launched and co-hosted a weekly video podcast, entitled HackerKast, with the Founder of WhiteHat Security, Jeremiah Grossman, and VP of WhiteHat Labs, Robert "RSnake" Hansen.

Director, Security Services & Research

Started and built Whitehat’s first satellite office - focusing on hiring dozens of new security engineers in Houston while maintaining the Silicon Valley SaaS startup culture. Took the team from 0-65+

Hired, trained, and managed the team and helped handle WhiteHat’s exploding customer base which went from a few hundred websites to tens of thousands during this period.

Launched our new product lines beyond our bread and butter web app security testing which included Static Code Analysis and other early development lifecycle integrations to better address the DevOps movement.

Acting figurehead representing WhiteHat Security at many local and national security events presenting on his technical security research as well as emerging threats and trends in the web application security field. (mattjay.github.io/talks)

Sr. Manager, Threat Research Center

- Lead a team of application security testers and engineers

Threat Research Center Supervisor

Web Application penetration tester for the Threat Research Center at WhiteHat Security responsible for identification of security vulnerabilities across tens of thousands of web applications.

Application Security Specialist

San Jose State University

- Taught the web application security section of a undergraduate level class on information security.

Instructor

Adelphi University

- Taught the web application security section of a undergraduate senior seminar on information security.

VerSprite, LLC

Security Consultant

Over the last two decades, I’ve helped make hundreds of organizations more secure.

My mission is to leave the Internet a more secure place than I found it.

I’m helping organizations handle billions of users' information securely and increasing brand’s trust among their customers.

I’m currently the Security Architect of Reddit.

My portfolio:

→ I’m the security architect of Reddit where I help design security into all facets of the business for the 4th largest social network in the US and a top 20 most visited website globally
→ I teach company’s how to protect against cyber attacks and save tens of millions of dollars in losses.
→ I coach entrepreneurs and CISOs that need help with infrastructure, application, cloud, and security policies.
→ I advise early-stage companies in cyber security best practices and help pass technical due diligence from investors and potential acquirers.
→ I invest in early-stage private technology companies focusing on cybersecurity, software infrastructure, employee productivity, and B2B/SaaS.
→ I volunteer for a selection of non-profits who’s missions I connect with who wouldn’t otherwise be able to afford technical and specifically security consulting services..

My results:

→ 50,000k+ applications with less vulnerabilities than when I found them
→ 1B+ users data security reliant on systems I designed or secured
→ $100M+ of startup exits using my security due diligence
→ 0 advertisements or cold calls
→ 100% due diligence success rate

If you want to work with me, get in touch:

Email: mattjohansen@proton.me
Twitter: @mattjay

Matt Johansen

First Citizens Bank

Reporting to the Chief Information Security Architect, duties include supporting the Systems Development Life Cycle (SDLC) as a reviewer and approver, contributing to the development of InfoSec standards, opportunistically identifying security concerns and driving them to remediation, supporting audit and regulatory activities, and helping ensure Bank solutions are reasonably secure.

Senior Information Security Architect

Falcon's View Consulting, LLC

As a solo consulting practice, providing cybersecurity professional services to multiple industries. Project work includes content development, security architecture, security product strategy and development, high-level security assessment and advisory services, specialized security training, and DevOps/DevSecOps architecture. Engagements include technical security ghost writing, program assessment based on NIST CSF, security advisory services on topics including risk management and container security, and general enterprise security architecture. My practice has been idle since mid-2019.

Principal

SmithRx

First full-time security hire for the company. Brought in to build out security program and security architecture roadmap, as well as to assist with completing critical audits and implementing various security practices. Work efforts completed include:
•	Core Security Program Design: Designed and created a roadmap for the build-out of core security program capabilities, including vulnerability management, risk management, data security, application and product security, third-party risk management, and business continuity management.
•	Critical Security-Related Processes: Designed and began implementing critical security processes through cross-team collaboration, including identity lifecycle, access management, routine security testing, vendor security reviews, cloud security monitoring, audit support, and policy revisions.
•	Security Tooling, Services, and Architecture: Identified security capability needs, designed solutions, evaluated vendors, and shepherded associated budget requests through review and approval. Solutioning included evaluating vendors for Managed Detection and Response (MDR), Cloud Security Posture Management (CSPM), application security testing, password vault/management, identity governance and administration (IGA), network remote access controls for sensitive environments, and container workload protection. Additionally, provided security architecture support to engineering teams around software designs and security-related questions.

Senior Corporate Security Engineer III

Entegral

Time was split between providing security architecture leadership, participating as an Enterprise Architect (EA) within the Engineering Board, participating in and helping evolve the Technology Adoption Process, and overall providing technical leadership for the organization. Additional EA support was also provided to the internal team responsible for user endpoints and corporate IT services.
 * Security Architecture: Led initiatives and provided guidance in several areas, including security program management, security policies and standards, security roadmap and strategy, prioritization of resolving security capability gaps, identification and implementation of security solutions, and generally representing security across the organization.
 * Engineering Board: The Engineering Board was comprised of all Entegral Enterprise Architects and provided technology oversight for the organization. Our stated mission was to “relentlessly pursue the iterative delivery of evolutionary, right-sized, secure, scalable software products.” We collaborated to facility awareness and cooperation across our respective value streams, as well as helping set standards and guide technology decisions that were aligned with strategic direction from the executive leadership team.
 * Technology Adoption Process: Participated as an EA in the review of new technology requests, as well as working collaboratively to evolve and optimize the process. The purpose of this process was to provide some high-level governance around introduction of new technologies (whether tools or services) into the organization without proper planning, consideration, or support.

Enterprise Security Architect

Equifax

Security EA assigned to cover SSDLC and container security, as well as other DevSecOps-related topics as they arise.

Security Enterprise Architect 

Performed security reviews of project designs to evaluate adherence to security technical requirements and for appropriateness of security controls and practices, including ensuring that a proper data flow diagram was in place and assisting teams with threat modeling during the project lifecycle. Assisted project teams with security solutioning when defined patterns meeting technical requirements did not exist. Participated in training delivered to technical architects and project leads on how to compose a data flow diagram and how to perform threat modeling. Completed foundational training on Google Cloud Platform.

Security Solutions Architect

Hobsons

Provided technical security leadership within the CloudOps team and across the Technology division. Day-to-day responsibilities included working with software development project teams to ensure proper cloud security measures were in place and maintained, leading tooling evaluations (e.g., log management, container and serverless security tools), leading log management platform migration (from Splunk to Devo), and leading clean- up of AWS IAM configurations (including a transition to AWS SSO). Worked in a matrixed relationship with the Security team to also provide input and propose direction on key capabilities such as security standards and operational security practices. Hobsons was dissolved in February/March 2021.

Cloud Security Architect

Hilton

Provided security architecture and strategy guidance to projects and teams on a variety of topics, including DevSecOps, application security testing, secure coding, secure application and system design, cloud and container security, and enterprise security. My day-to-day activities included reviewing or advising project designs, working within internal security resources on testing approaches, planning and developing security standards, and being a general advocate for information security across the organization.

Principal Application Security Architect

Pearson

Provided front-line management of a team of security engineers and architects responsible for identity and access management (IAM), multi-factor authentication (MFA), cloud security, container security, and data security (including encryption and certificate management). Provided technical leadership for the IAM and MFA initiative, including support for solution design and program communications.

Manager, Security Engineering and Architecture

New Context

Served in a variable role performing research, product management of in-house development projects, and conducting business development. Efforts included creation of materials around the "Lean Security" methodology, development of presentations for conferences, and writing copy for sales collateral, blog posts, and byline articles. New Context has a focus on secure DevOps services and product development.

Principal Security Scientist

Ellucian

Evaluated current security processes, tools, and practices as a member of the information security team reporting directly to the CISO. Charged with evaluating the effectiveness of current solutions and identifying gaps in security protection. Developed a comprehensive security architecture framework to evaluate and manage security architecture strategy for both traditional on-premises and cloud environments. Worked with vendors and cross-organizationally to identify, evaluate, and test (pilot) solutions. Technologies evaluated included data loss prevention (DLP), endpoint detection and response (EDR), traditional endpoint security, email security solutions (on-premises and Office 365), enterprise mobility management (EMM), network security tools and capabilities, identity and access management tools and capabilities, application security practices, cloud security tools (such as for AWS) and container (Docker) security tools. Technologies in-scope included AWS, Okta, Digital Guardian, IBM BigFix, Symantec EPP, Zscaler, Microsoft Adallom, FireEye, Splunk, Ansible, Rapid7, Tenable, CloudCheckr, StackRox, Jump Cloud, among many others.

Manager, Information Security Architecture

Ben Tomhave is a security industry veteran, progressive thinker, and culture warrior. He holds a MS in Engineering Management from The George Washington University, a BA in Computer Science from Luther College, is a CISSP, and is a graduate of the BJ Fogg Behavior Design Boot Camp. He's previously held positions with Hilton, Gartner, AOL, Wells Fargo, ICSA Labs, LockPath, and E&Y. He is former co-chair of the American Bar Association Information Security Committee, a senior member of ISSA, former board member for the Society of Information Risk Analysts, and former board member for OWASP NoVA. He is a published author and experienced public speaker, including engagements with the RSA Conference, MISTI, ISSA, RMISC, Secure360, RVAsec, DevOps Connect, as well as Gartner events.

taplio

The Battle

Matt Johansen

Ben Tomhave

Followers

Posts

Engagements

Likes

Ready to grow your LinkedIn presence?