Reddit, Inc.

Leading Reddit's software security team which focuses on AppSec, ProdSec, and a secure by default developer experience.

Head of Software Security

I'm designing and implementing security systems into all facets of Reddit's business. Protecting our company's employees and our website's users is my team's main focus.

Principal Security Architect

Aviso Ventures

Limited Partner

Bank of America

A senior security leader responsible for a large team, focused on Infrastructure Security Testing.
Responsibilities have included:

Management of our Vulnerability Scanning program continuously scanning millions of endpoints and thousands of web applications,
Enterprise Remediation Governance - partnering with our infrastructure owners to remediate vulnerabilities within given SLAs,
Management of our baseline compliance monitoring program, and
Management of our Internet Hygiene and perimeter analysis.

Previously led our cloud, container, and DevOps security programs for a hybrid, multi-cloud architecture.

SVP, Sr Security Manager, Cyber Security Defense

If it's a Cloud, Containerization, or DevOps initiative it's on my desk.

My job to work with all security control owners to operationalize their control in all major public cloud providers and Kubernetes or OpenShift environments.

SVP, Cyber Security Technology - Cloud Security Architect

Liquidmatrix Security Digest

- Write articles about current events in the security world and my personal take on them.
- Host a weekly podcast about current events in the security industry.

Writer & Podcast Co-Host

Goldman Sachs

- One of 3 CISOs of consumer facing divisions at Goldman. (Honest Dollar, Marcus, and GS Bank)

Vice President

Honest Dollar

Acting CISO, built an Information Security program from the ground up at a Financial Tech startup.
- Build secure SDLC, testing, and monitoring around a FinTech application running in Google Cloud on Kubernetes hosting a ReactJS, Go, iOS/Android application and backend financial connections.
- Manage creation and maintenance of policies
- Prove secure foundations during acquisition due diligence by Goldman Sachs

Head of Security [ Acquired by Goldman Sachs NYSE: GS ]

WhiteHat Security

Transitioned out of people management for my last stint at WhiteHat and really focused on industry leadership, sales enablement, content creation, partnership building, and new product launches.

This includes but is not limited to:
- Remediation Assistance & Guidance
- Secure Development Training
- Risk Based Vulnerability Prioritization
- SDLC Architecture Review
- AppSec Program Building
- Asset Discovery

Launched and co-hosted a weekly video podcast, entitled HackerKast, with the Founder of WhiteHat Security, Jeremiah Grossman, and VP of WhiteHat Labs, Robert "RSnake" Hansen.

Director, Security Services & Research

Started and built Whitehat’s first satellite office - focusing on hiring dozens of new security engineers in Houston while maintaining the Silicon Valley SaaS startup culture. Took the team from 0-65+

Hired, trained, and managed the team and helped handle WhiteHat’s exploding customer base which went from a few hundred websites to tens of thousands during this period.

Launched our new product lines beyond our bread and butter web app security testing which included Static Code Analysis and other early development lifecycle integrations to better address the DevOps movement.

Acting figurehead representing WhiteHat Security at many local and national security events presenting on his technical security research as well as emerging threats and trends in the web application security field. (mattjay.github.io/talks)

Sr. Manager, Threat Research Center

- Lead a team of application security testers and engineers

Threat Research Center Supervisor

Web Application penetration tester for the Threat Research Center at WhiteHat Security responsible for identification of security vulnerabilities across tens of thousands of web applications.

Application Security Specialist

San Jose State University

- Taught the web application security section of a undergraduate level class on information security.

Instructor

Adelphi University

- Taught the web application security section of a undergraduate senior seminar on information security.

VerSprite, LLC

Security Consultant

Over the last two decades, I’ve helped make hundreds of organizations more secure.

My mission is to leave the Internet a more secure place than I found it.

I’m helping organizations handle billions of users' information securely and increasing brand’s trust among their customers.

I’m currently the Security Architect of Reddit.

My portfolio:

→ I’m the security architect of Reddit where I help design security into all facets of the business for the 4th largest social network in the US and a top 20 most visited website globally
→ I teach company’s how to protect against cyber attacks and save tens of millions of dollars in losses.
→ I coach entrepreneurs and CISOs that need help with infrastructure, application, cloud, and security policies.
→ I advise early-stage companies in cyber security best practices and help pass technical due diligence from investors and potential acquirers.
→ I invest in early-stage private technology companies focusing on cybersecurity, software infrastructure, employee productivity, and B2B/SaaS.
→ I volunteer for a selection of non-profits who’s missions I connect with who wouldn’t otherwise be able to afford technical and specifically security consulting services..

My results:

→ 50,000k+ applications with less vulnerabilities than when I found them
→ 1B+ users data security reliant on systems I designed or secured
→ $100M+ of startup exits using my security due diligence
→ 0 advertisements or cold calls
→ 100% due diligence success rate

If you want to work with me, get in touch:

Email: mattjohansen@proton.me
Twitter: @mattjay

Matt Johansen

🐙 Gal Shpantzer

IANS

Faculty

Securosis

Contributing Analyst

MACH37 CyberSecurity Startup Accelerator

Mentor and advisor to the next generation of security startup founders at Mach37, a vertical accelerator focused on information security product companies. Twice a year, Mach37 invests in a class of 6-10 security startups, each of which participates in an intensive 3-month program of coaching and validation of their products and markets, culminating in a Demo Day presentation to investors.

Mentor, Mach37 Stars Network

Security Outliers Research Project

The Security Outliers research project's goal is to study how culture affects safety and security outcomes in high-risk professions such as aviation, surgery and medicine, special operations (police and military).  Created by Gal Shpantzer along with Dr. Christophe Veltsos in early 2009, the project's activities focus on surveying existing academic research on the systems and cultural aspects of risk management, supplemented by interviews with practitioners and researchers in high-risk professions.  Security Outliers brings proven concepts gathered by our research to the management of information security. The official unveiling of Security Outliers was at the RSA Security conference in March, 2010.  The next phase was to expand the scope of the project post-RSA, with Shpantzer and Veltsos continuing the research, with a website, blog, discussion list and training programs focusing on emerging leadership in the information security space.  In 2011 the project moved into the 'experiential' phase where we go past reading and talking about risk and start doing risky things.  The pinnacle of these activities was a week-long immersion course, simulating US Navy SEAL selection and training.  I am still planning adventures in order to learn more about culture as a risk management tool.

Co-Founder

Security Consulting Company

As part of my daily routine, I work with security decision-makers from multi-billion dollar global conglomerates, major universities, hospital chains and niche R&D startups.  I establish and implement strategic security initiatives for their internal and external clients.  

Examples of regular projects:  Establish project teams with relevant vendors and consultants to successfully complete finite security projects, as well as to upgrade ongoing security processes for compliance and effective management of natural and man-made risks to information assets and business continuity. 

Proactively seek out innovators and pioneers in the infosec industry for inclusion in the solution matrix, which I present to senior management at the conglomerate, for inclusion in the strategic security roadmap. 

Coordinate continuing training and education of client's technical staff as well as my internal consulting resources.

Security Advisory

SANS Institute

Co-edit the SANS Newsbites, a twice-weekly electronic newsletter that goes out to over 161,000 opt-in subscribers.
This is a technical editing effort, with the opportunity to add short commentary to explain implications of news items to the larger security community, as well as to add relevant sources of further research into current events in the infosec arena.  I was on the editorial board from 2002 to 2008 and as of November 2012, I am back on the board after a four year hiatus.

See archive here:  http://www.sans.org/newsletters/newsbites/

Co-Editor, SANS Newsbites

Energy Sector Security Consortium, Inc. (EnergySec)

DC-based security advisor to EnergySec and liaison to power sector cybersecuirty activities in the area.  Sample activities: Participate as a subject matter expert (SME) in the DoE/DHS development of the Electric Subsector Cybersecurity Capability Maturity Model (ESC2M2) http://energy.gov/oe/services/cybersecurity/electricity-subsector-cybersecurity-capability-maturity-model 

Participate in the Publicly Accessible Control Systems Working Group (www.PACSWG.org), to help identify vulnerable control systems and alert owners to the status of their assets.

Senior Security Advisor

NIST SmartGrid Interoperability

In May/June of 2009, I created and led the privacy-oriented subgroup to the CSCTG at NIST's SmartGrid Interoperability project.  Identified and recruited core team members from the security and privacy communities who would develop the privacy section of the NIST draft deliverable to the Dep't of Commerce and Energy in September of 2009.  This effort is now a global reference for smart grid privacy.  I turned over management of the effort to Rebecca Herold, who was one of the original 'core four' SMEs on the project, since she is focused on privacy in a full-time capacity.
See deliverable here: http://www.nist.gov/public_affairs/releases/smartgrid_interoperability.pdf and http://csrc.nist.gov/publications/drafts/nistir-7628/draft-nistir-7628.pdf

Founder, Privacy Subgroup (Volunteer)

Regional Non-Profit

Responsible for Information Security, Physical Security and Liaison to Law Enforcement for a politically sensitive non-profit in the Midwest.  The org's mission, visibility and activities made the organization itself and its affiliates a target for vicious hate mail, death threats and other unwanted attention by organized neo-nazis as well as radical leftist groups... 
 
My duties included security of the network, sorting and handling of threats and security incidents in a three-state area, as well as coordination for physical security and executive protection of visiting dignitaries.  Executive protection coordination included intense advance work with federal and local law enforcement, as well as private security firms and community leaders.  Protectees included controversial private sector speakers as well as foreign ambassadors and former Prime Ministers.

Director of Security

American Red Cross

As a volunteer EMT for the Red Cross, we did onsite emergency medical support for just about every sort of situation you can think of.  Trauma care examples included treating injured concert-goers who got 'ballistically ejected' from the moshpit, to treating trauma victims in gang incidents, to fights at the BierGarten at the State Fair.

Non-trauma related care included treating severely hallucinatory teenagers at the Phish concert and elderly patients with coronary problems.  It really ran the gamut and was a tremendous learning experience in how to deal with people in stressful and awkward situations.

Emergency Medical Technician (EMT)

As an Information Security and Risk Management professional, my goal is to help make security less mysterious, less expensive and less disruptive.

My team of subject matter experts strives to learn about our clients' business processes and what's most important and sensitive to them, as part of the overall risk management approach.  Security solutions, from administrative to technical, are then tailored to the particular culture of the organization, to maximize acceptance of the solutions by the IT staff and the end users within that organization.

Security isn't easy, however security doesn't have to be about Fear, Uncertainty and Doubt.  Rather, security should be as proactive and predictable as possible, in order to reduce "firefighting" and emergency spending on reactive approaches to security incidents.  The Total Cost of Ownership for security solutions is thus reduced to a more manageable figure, which is baked into the overall budget and the business processes that support the client's strategic goals.

Specialties: Ransomware prevention and response; Security Budgeting and vendor negotiations; Web Application Security; Vulnerability Management (Identification, prioritization Remediation); Identity Management; Authentication; Managed Security Services; Wireless Security; Network Access Control; Log Retention & Management;  User Behavior Analytics; full disk encryption; Disaster Recovery; Business Continuity Planning; DNS security; DDoS mitigation;

taplio

The Battle

Matt Johansen

🐙 Gal Shpantzer

Followers

Posts

Engagements

Likes

Ready to grow your LinkedIn presence?