Reddit, Inc.

Leading Reddit's software security team which focuses on AppSec, ProdSec, and a secure by default developer experience.

Head of Software Security

I'm designing and implementing security systems into all facets of Reddit's business. Protecting our company's employees and our website's users is my team's main focus.

Principal Security Architect

Aviso Ventures

Limited Partner

Bank of America

A senior security leader responsible for a large team, focused on Infrastructure Security Testing.
Responsibilities have included:

Management of our Vulnerability Scanning program continuously scanning millions of endpoints and thousands of web applications,
Enterprise Remediation Governance - partnering with our infrastructure owners to remediate vulnerabilities within given SLAs,
Management of our baseline compliance monitoring program, and
Management of our Internet Hygiene and perimeter analysis.

Previously led our cloud, container, and DevOps security programs for a hybrid, multi-cloud architecture.

SVP, Sr Security Manager, Cyber Security Defense

If it's a Cloud, Containerization, or DevOps initiative it's on my desk.

My job to work with all security control owners to operationalize their control in all major public cloud providers and Kubernetes or OpenShift environments.

SVP, Cyber Security Technology - Cloud Security Architect

Liquidmatrix Security Digest

- Write articles about current events in the security world and my personal take on them.
- Host a weekly podcast about current events in the security industry.

Writer & Podcast Co-Host

Goldman Sachs

- One of 3 CISOs of consumer facing divisions at Goldman. (Honest Dollar, Marcus, and GS Bank)

Vice President

Honest Dollar

Acting CISO, built an Information Security program from the ground up at a Financial Tech startup.
- Build secure SDLC, testing, and monitoring around a FinTech application running in Google Cloud on Kubernetes hosting a ReactJS, Go, iOS/Android application and backend financial connections.
- Manage creation and maintenance of policies
- Prove secure foundations during acquisition due diligence by Goldman Sachs

Head of Security [ Acquired by Goldman Sachs NYSE: GS ]

WhiteHat Security

Transitioned out of people management for my last stint at WhiteHat and really focused on industry leadership, sales enablement, content creation, partnership building, and new product launches.

This includes but is not limited to:
- Remediation Assistance & Guidance
- Secure Development Training
- Risk Based Vulnerability Prioritization
- SDLC Architecture Review
- AppSec Program Building
- Asset Discovery

Launched and co-hosted a weekly video podcast, entitled HackerKast, with the Founder of WhiteHat Security, Jeremiah Grossman, and VP of WhiteHat Labs, Robert "RSnake" Hansen.

Director, Security Services & Research

Started and built Whitehat’s first satellite office - focusing on hiring dozens of new security engineers in Houston while maintaining the Silicon Valley SaaS startup culture. Took the team from 0-65+

Hired, trained, and managed the team and helped handle WhiteHat’s exploding customer base which went from a few hundred websites to tens of thousands during this period.

Launched our new product lines beyond our bread and butter web app security testing which included Static Code Analysis and other early development lifecycle integrations to better address the DevOps movement.

Acting figurehead representing WhiteHat Security at many local and national security events presenting on his technical security research as well as emerging threats and trends in the web application security field. (mattjay.github.io/talks)

Sr. Manager, Threat Research Center

- Lead a team of application security testers and engineers

Threat Research Center Supervisor

Web Application penetration tester for the Threat Research Center at WhiteHat Security responsible for identification of security vulnerabilities across tens of thousands of web applications.

Application Security Specialist

San Jose State University

- Taught the web application security section of a undergraduate level class on information security.

Instructor

Adelphi University

- Taught the web application security section of a undergraduate senior seminar on information security.

VerSprite, LLC

Security Consultant

Over the last two decades, I’ve helped make hundreds of organizations more secure.

My mission is to leave the Internet a more secure place than I found it.

I’m helping organizations handle billions of users' information securely and increasing brand’s trust among their customers.

I’m currently the Security Architect of Reddit.

My portfolio:

→ I’m the security architect of Reddit where I help design security into all facets of the business for the 4th largest social network in the US and a top 20 most visited website globally
→ I teach company’s how to protect against cyber attacks and save tens of millions of dollars in losses.
→ I coach entrepreneurs and CISOs that need help with infrastructure, application, cloud, and security policies.
→ I advise early-stage companies in cyber security best practices and help pass technical due diligence from investors and potential acquirers.
→ I invest in early-stage private technology companies focusing on cybersecurity, software infrastructure, employee productivity, and B2B/SaaS.
→ I volunteer for a selection of non-profits who’s missions I connect with who wouldn’t otherwise be able to afford technical and specifically security consulting services..

My results:

→ 50,000k+ applications with less vulnerabilities than when I found them
→ 1B+ users data security reliant on systems I designed or secured
→ $100M+ of startup exits using my security due diligence
→ 0 advertisements or cold calls
→ 100% due diligence success rate

If you want to work with me, get in touch:

Email: mattjohansen@proton.me
Twitter: @mattjay

Matt Johansen

GitHub

* Participating in Responsible AI Red Team assessments on GitHub Advanced Security Artificial Intelligence (AI) capabilities, such as the “Auto Fix” functionality that was launched in private beta to customers in January of 2024.

* Guiding businesses on the adoption of DevSecOps practices at scale with the GitHub Advanced Security product suite across various industry verticals, including Technology, FinTech, Insurance, Financial, Healthcare, Automotive, and Systems Integration companies.

Principal Security Specialist (Field)

* Developed novel CodeQL queries to identify exploitable vulnerabilities in customer’s native code.

* Customized and Remediated issues within public CodeQL queries in support of open source static analysis at scale.

* Acted as a subject matter expert on the practices of Static Analysis, DevSecOps, and Application Security during internal meetings with Product Management and Engineering.

Code Scanning Architect (Field)

Securing.dev

Founder

Thermo Fisher Scientific

* Led the Collaboration Technologies, Global Messaging, and Service Technologies teams as we strive to deliver a great experience through the software our colleagues leverage to do business.

* Drove the core principles of "security by design” by reducing friction between Security and IT, while expediting the development and/or adoption of innovative and secure technologies.

* Enabled holistic management of technology use by colleagues in order to create a universal digital experience that is centered around the needs of the business and its customers.

* Created both dynamic and stable technology platforms that integrate practices from development, security, and operations to increase automation, scalability, and reliability.

Director, Application Experience

* Leading the Conference, Office, and Service Technologies teams as we strive to deliver a great colleague experience through the software they leverage to do business.

* Driving the core principles of "security by design” by reducing friction between Security and IT, while expediting the development and/or adoption of innovative and secure technologies.

* Enabling holistic management of technology use by colleagues in order to create a universal digital experience that is centered around the needs of the business and its customers.

* Creating both dynamic and stable technology platforms that integrate practices from development, security, and operations to increase automation, scalability, and reliability.

Senior Manager, Application Experience

*  Led a globally distributed team of senior managers, managers, engineers, and researchers responsible for software security testing across all company business units and products.

* Authored the company's original “Security by Design” program; responsible for providing guidance on how to architect and build security into the software development lifecycle.

Senior Manager, Global DevSecOps

* Built a distributed team of engineers and researchers to address core technical and administrative capabilities within the software security domain.

* Authored the company's original software security strategy; responsible for architecting and implementing security testing as part of the software development lifecycle.

* Architected the company's centralized version control strategy, designed to improve software development efficiency and security across the organization.

* Designed training toward building a secure software development lifecycle; implemented multiple paid and open source solutions to add breadth of coverage at scale.

Manager of DevSecOps

InfoSec Mentors Project

Lead Developer

Security Weekly Productions

Host, Application Security Weekly (episodes 0-55)

Podcast Host

Bugcrowd

* Administered training to internal resources regarding complex application security concepts.

* Built and maintained automation tools to enhance the quality and speed of program launches.

* Engaged in technical guidance to both executives and practitioners toward establishing and maintaining effective Bug Bounty programs at scale.

Solutions Architect

* Designed and engineered proof-of-concept applications and security research tooling.

* Led development of Bugcrowd’s security researcher training initiative as Project Manager.

* Spoke at (or acted as a technical resource for) industry trade shows and conferences, including BSides Las Vegas, Black Hat, DEFCON, DerbyCon, and HackFest Canada.

Trust & Security Engineer

Rapid7

* Provided guidance to CISOs, Executive Directors, and security practitioners on how to develop vulnerability management programs at scale across global corporations.

* Led training engagements for Penetration Testing and Web Application Security practitioners.

* Consulted with executives on how to build effective corporate information security programs.

Security Engineer

NuHarbor Security

Penetration Tester

Veracode

Code Security Engineer

OSCP | Principal Security Specialist, GitHub

I am an early pioneer of Responsible AI Red Team practices, with an Offensive Security Certified Professional (OSCP) designation and years of experience building DevSecOps programs in Fortune 100 enterprise organizations. I have a collegiate education in both Computer Science and Psychology, which has afforded me a unique perspective in this historic moment as companies seek to safely and securely deploy Artificial Intelligence (AI) technologies at scale.

taplio

The Battle

Matt Johansen

Keith Hoodlet

Followers

Posts

Engagements

Likes

Ready to grow your LinkedIn presence?