Reddit, Inc.

Leading Reddit's software security team which focuses on AppSec, ProdSec, and a secure by default developer experience.

Head of Software Security

I'm designing and implementing security systems into all facets of Reddit's business. Protecting our company's employees and our website's users is my team's main focus.

Principal Security Architect

Aviso Ventures

Limited Partner

Bank of America

A senior security leader responsible for a large team, focused on Infrastructure Security Testing.
Responsibilities have included:

Management of our Vulnerability Scanning program continuously scanning millions of endpoints and thousands of web applications,
Enterprise Remediation Governance - partnering with our infrastructure owners to remediate vulnerabilities within given SLAs,
Management of our baseline compliance monitoring program, and
Management of our Internet Hygiene and perimeter analysis.

Previously led our cloud, container, and DevOps security programs for a hybrid, multi-cloud architecture.

SVP, Sr Security Manager, Cyber Security Defense

If it's a Cloud, Containerization, or DevOps initiative it's on my desk.

My job to work with all security control owners to operationalize their control in all major public cloud providers and Kubernetes or OpenShift environments.

SVP, Cyber Security Technology - Cloud Security Architect

Liquidmatrix Security Digest

- Write articles about current events in the security world and my personal take on them.
- Host a weekly podcast about current events in the security industry.

Writer & Podcast Co-Host

Goldman Sachs

- One of 3 CISOs of consumer facing divisions at Goldman. (Honest Dollar, Marcus, and GS Bank)

Vice President

Honest Dollar

Acting CISO, built an Information Security program from the ground up at a Financial Tech startup.
- Build secure SDLC, testing, and monitoring around a FinTech application running in Google Cloud on Kubernetes hosting a ReactJS, Go, iOS/Android application and backend financial connections.
- Manage creation and maintenance of policies
- Prove secure foundations during acquisition due diligence by Goldman Sachs

Head of Security [ Acquired by Goldman Sachs NYSE: GS ]

WhiteHat Security

Transitioned out of people management for my last stint at WhiteHat and really focused on industry leadership, sales enablement, content creation, partnership building, and new product launches.

This includes but is not limited to:
- Remediation Assistance & Guidance
- Secure Development Training
- Risk Based Vulnerability Prioritization
- SDLC Architecture Review
- AppSec Program Building
- Asset Discovery

Launched and co-hosted a weekly video podcast, entitled HackerKast, with the Founder of WhiteHat Security, Jeremiah Grossman, and VP of WhiteHat Labs, Robert "RSnake" Hansen.

Director, Security Services & Research

Started and built Whitehat’s first satellite office - focusing on hiring dozens of new security engineers in Houston while maintaining the Silicon Valley SaaS startup culture. Took the team from 0-65+

Hired, trained, and managed the team and helped handle WhiteHat’s exploding customer base which went from a few hundred websites to tens of thousands during this period.

Launched our new product lines beyond our bread and butter web app security testing which included Static Code Analysis and other early development lifecycle integrations to better address the DevOps movement.

Acting figurehead representing WhiteHat Security at many local and national security events presenting on his technical security research as well as emerging threats and trends in the web application security field. (mattjay.github.io/talks)

Sr. Manager, Threat Research Center

- Lead a team of application security testers and engineers

Threat Research Center Supervisor

Web Application penetration tester for the Threat Research Center at WhiteHat Security responsible for identification of security vulnerabilities across tens of thousands of web applications.

Application Security Specialist

San Jose State University

- Taught the web application security section of a undergraduate level class on information security.

Instructor

Adelphi University

- Taught the web application security section of a undergraduate senior seminar on information security.

VerSprite, LLC

Security Consultant

Over the last two decades, I’ve helped make hundreds of organizations more secure.

My mission is to leave the Internet a more secure place than I found it.

I’m helping organizations handle billions of users' information securely and increasing brand’s trust among their customers.

I’m currently the Security Architect of Reddit.

My portfolio:

→ I’m the security architect of Reddit where I help design security into all facets of the business for the 4th largest social network in the US and a top 20 most visited website globally
→ I teach company’s how to protect against cyber attacks and save tens of millions of dollars in losses.
→ I coach entrepreneurs and CISOs that need help with infrastructure, application, cloud, and security policies.
→ I advise early-stage companies in cyber security best practices and help pass technical due diligence from investors and potential acquirers.
→ I invest in early-stage private technology companies focusing on cybersecurity, software infrastructure, employee productivity, and B2B/SaaS.
→ I volunteer for a selection of non-profits who’s missions I connect with who wouldn’t otherwise be able to afford technical and specifically security consulting services..

My results:

→ 50,000k+ applications with less vulnerabilities than when I found them
→ 1B+ users data security reliant on systems I designed or secured
→ $100M+ of startup exits using my security due diligence
→ 0 advertisements or cold calls
→ 100% due diligence success rate

If you want to work with me, get in touch:

Email: mattjohansen@proton.me
Twitter: @mattjay

Matt Johansen

Anysphere

Securing Cursor 🤖 - hiring very strong security engineers (US only)

Security

Authzed, Bowtie, Cider Security (Acquired), Compliance Cow, Conductor One, Crash Override, Decipher AI, Desired Effect, DevArmor, DevZero, Depot.dev, Dig Security (Acquired), Endor Labs, Impart Security, Knostic, Leen, Monad, Noma Security, Night Vision, Ollama, Passage.id (Acquired), PatcherAI, Permiso Security, Prophet Security, Revel, Risk Profiler, Seclytics, seedata.io, Semgrep, SigNoz, SINAI Technologies, Sola Security, Snapser, SPIRL, Sweet Security, Temporal, Terra Security, Tines, Tonic Security, Truffle Security, Zip Security, Zylon

Angel Investor

Current: Accuknox, Impart Security, Permiso Security, Step Security
Previous: Appaegis, Avatao, Cider Security, Cockroach Labs, Ermetic, Temporal

Advisor

404 Security Not Found

Co-host

Resourcely (acquired by Anysphere)

Co-founder and CEO

Databricks

Head of Product Security

Netflix

I led a team of experienced security software engineers that build automation to keep Netflix applications secure in a rapidly changing DevOps environment. Our team's mandate was to automatically provide optimal security context to developers and secure defaults when possible.

Application Security Engineering Manager

On the Cloud Infrastructure Security team I was responsible for securing one of the largest AWS environments in the world. I contributed to security strategy and project execution. In this role I was the the lead developer and architect for the Repokid OSS project that applies least privilege across our AWS deployment.

I also designed and launched a program to improve threat detection and response capabilities for our cloud environment, and regularly worked with leadership on strategic planning initiatives. 

My role included representing our security organization at conferences and presentations delivered to security practitioners and developers (Black Hat USA, AWS re:Invent, Enigma) and students (UC Berkeley, Carnegie Mellon).

Senior Cloud Security Engineer

In this role I reported to IBM’s Cloud CSO and advised teams in a 10K+ engineer organization on risk and improving security posture across the IBM Cloud Business Unit. My work included serving as lead for a new cloud architecture in development and leading architecture reviews. 

During this time I also co-founded the Cloud Foundry Security team with security engineers from other organizations to identify and triage security issues in Cloud Foundry, and I was co-designer for a scalable security architecture review program and a self-service code analysis platform.

Sr. Security Architect

HP Helion

At HPE I worked on Public and Private Cloud platforms, participating in threat models and security reviews to identify product defects. In this role I was also lead developer and architect for two open source projects, Bandit (Python security linter) and ReconBF (measures/reports security control implementation on Linux systems at scale). 

I also created security education curriculum for Python development teams.

Security Architect

Symantec

I led the gate testing and static analysis effort for Symantec Cloud and OpenStack Security Group, designed and automated security test cases, and coordinated penetration testing.

Senior Software Engineer

I was hired as a security-focused QA and automation engineer working on Symantec's DLP product, responsible for pentesting, threat modeling, and automating security test cases.

Senior SQA Engineer

I am a senior information security professional with over a decade of experience spanning people management, cloud security, application security, and automation for Databricks, Netflix, IBM, HP, and Symantec.

I work with startups as an advisor and investor in my spare time. I enjoy using what I have learned to make small companies more successful by advising leadership about how to build effective security programs and position strategically within the security market.

My open source experience includes serving as lead developer/architect on popular projects Repokid and Bandit. I am an extrovert and have deep involvement in the security community, serving as the Bay Area OWASP chapter leader. I have been a guest on several security-related podcasts and delivered presentations at conferences AWS re:Invent, Black Hat USA, Enigma, AppSec Cali, BSides SF, and QCon SF. 

I hold an MS in Information Assurance from Santa Clara University and a BS in Computer Science from CSU Long Beach.

taplio

The Battle

Matt Johansen

Travis McPeak

Followers

Posts

Engagements

Likes

Ready to grow your LinkedIn presence?