Latio Tech

A trusted resource for cloud & application security product comparisons - opinions are my own and links below:

- Cloud Security List - https://list.latio.tech
- In depth product analysis newsletter - https://pulse.latio.tech
- YouTube Channel - https://youtube.com/@latiotech
- GitHub Testing Repo - https://github.com/latiotech/insecure-kubernetes-deployments
- LinkedIn Learning - https://www.linkedin.com/learning/application-security-posture-management-security-from-the-supply-chain-to-cloud-runtime/

We do not hold equity in any cybersecurity companies

Founder & CEO

PagerDuty

Securing the world's operations tools - the right information at the right time can change the world!

- FEDRAMP, FEDRAMP, FEDRAMP!
- AWS, Containers, K8s, SDLC pipelines, and a bunch of other cloud native stuff

Security Engineer III

ReliaQuest

Lead all aspects of product security for GreyMatter, a SaaS security operations platform.

Manage a team of Product Security Engineers to deliver meaningful product improvements such as CSP, RBAC, CSRF protections, and custom scanning logic.

Subject Matter Expert for AWS, Kubernetes, Container, CI/CD, and Code Security.

Lead Threat Modeling Exercises, Developer Training, DevOps Training, and Compliance Attestation requirements (ISO 27001, SOC 2, FEDRAMP, and PCI).

Manage a team of Product Security Engineers to deliver meaningful product improvements such as CSP, RBAC, CSRF protections, and custom scanning logic.

Deploy, develop, and maintain a suite of security tools that enable DevSecOps such as Snyk (SCA, SBOMM, SAST, Container, Cloud, IAC), StackHawk (DAST and GraphQL), GitLab tooling, Sysdig, Prisma Cloud, and many others.

Develop internal cloud security tooling and training using Spotbugs, Cloudquery, OWASP standards and numerous open source projects.

Responsible for the cloud security architecture of over 300 Java SpringBoot MicroServices, running across multiple clouds and clusters. Daily usage of modern DevOps tooling such as Kong, Argo, DataDog, Grafana, and Prometheus.

Responsible for the remediation of hundreds of vulnerabilities, the implementation of modern web security standards, passing SOC 2, PCI, and ISO audits, and successful pentests.

Regular participant in industry thought leadership, sales calls, and customer success initiatives.

Sr. Cloud Security Engineer

Very Good Security

Security architect of Very Good Security Products - compliance automation, data aliasing, secure data processing, and payment multiplexing solutions

Directly managed and collaborated with a team of SME’s across engineering and compliance to maximize the product impact of integrations and framework support

Directly contribute to documentation, technical videos, sales engagements, and feature deployments - both in terms of product guidance and direct development using Ruby, JavaScript, Markdown, Docker, Python, Bash and other technologies.

Develop, maintain, and implement over 200 security automations and monitors across 13 compliance frameworks such as SOC 2, ISO 27001, PCI, HIPAA, NIST and GDPR.

Provide security engineering and architecture guidance for over 100 clients, across most modern clouds, source code control, vulnerability, device management, containerized Kubernetes and security platforms.

Develop 300+ tasks for helping both business and engineering teams achieve compliance and security standards, cross mapping tasks across 13 compliance frameworks and creating monitors for all tasks.

Create and lead combined initiatives across marketing, sales, product, and development teams, bringing major features to market such as quantitative risk management, cloud monitoring, employee onboarding, and new integrations. 

Contributor to numerous open source cloud security projects

Directly maintain and develop implementation guidelines for AWS, GCP, Azure, GSuite, Github, Gitlab, Bitbucket, KnowBe4, BambooHR, Rippling, Gusto, Slack, Jamf, Okta, Jira, Office 365, Azure AD, JumpCloud, Citrix, Snyk, SonarQube, WhiteSource, Kiuwan, Prisma (Twistlock), Splunk, DataDog, Ansible, and more.

DevOps experience contributing to Docker projects and Kubernetes security best practices - from vulnerability scanning with Aquasec to networking with Calico and AWS CNI’s. Contribute to internal security CI/CD security, AppSec and AWS architecture security.

Cloud Security Architect

Responsible for the security of GreyMatter, the world's first open XDR that empowers the full security incident response workflow.

Security implementation and management of IAM, EKS, CI/CD, SAST, DAST, GraphQL API Scanning, SSH, ELK, APM tools, DataDog, Splunk, QRadar, WAF, Palo Alto, Prisma Cloud and everything that goes into securing a modern multi-cloud web platform. 

Implemented proper controls at all phases of the development process: IAM, Kubernetes infrastructure, Gitlab deployment, firewalling and application layer.

Coordination across Dev, DevOps, DevSecOps, Infrastructure, and Security.

Cloud Security Engineer

The Southern Baptist Theological Seminary

Assist Dr. Ted Cabal in creating coursework and grading for Philosophy courses.
Assist Dr. Douglas Blount in grading for Philosophy courses.
Independently teach and manage online courses.

Graduate Teaching Assistant

Spartan Race, Inc.

Led all IT management and support across 42 countries, 250+ annual events, and 400 employees for a company with $100M+ revenue. 

Directly managed a team of three systems engineers responsible for maintaining the health of cloud and on premise environments

Generated $1M+ of annual savings in first year of employment.

Architect of Microsoft stack running in a hybrid cloud - VMWare, AWS, and GCP.

Managed vendor deployments with Apple, CDW, Autodesk, Adobe, Microsoft, VMWare and Google to conduct $2M+ dollars of purchasing a year.

Led successful cyber-security audit and security implementations for financial and healthcare sponsorship deals using NIST and ISO 27001; PCI and HIPAA experience.

GSuite subject matter expert - alpha programs and implementation.

Secured diverse environment of Mac and Windows desktops, laptops, Androids, iPhones, iPads, Kindle Fires, Chromebooks, and Linux machines.

IT Operations Manager

Atlas Professional Services

IT project design and support for over 300 national companies across all sectors

Consultations on hybrid-cloud, colocation, network, security, backup, and data.

Consulted small to medium size businesses on achieving NIST compliance with AWS and on premise data stores.

Demonstrated technical proficiency with the following: Windows Server 2008-2016, Datto, Veeam, Acronis, ESXi 5-6.7, Dell and HP Servers and SANs, various firewalls, switches, and routers, S3, EC2, Citrix, Active Directory, Office 365, GSuite, SQL, Powershell and Connectwise Suite RMM.

Systems Engineer

10+ years in engineering and security before founding Latio Tech to help security engineers cut through the marketing noise and find the technical details of products.

I have a passion for driving security teams as contributors to product (the true meaning of DevSecOps) and built Latio Tech to help connect people with the right products.

The best way that Wiz can dispel the narratives that they'd slow down post acquisition is by just not slowing down, and the team made four major launches at their Wizdom event today:

M365 Connector - bringing more posture and threat detection capabilities into what's typically considered SaaS security, expanding beyond what's generally considered "cloud only" tools like Snowflake and GitHub

Agentless workload detections - taking a novel approach to agentless workload threat detection by looking at SSH and application logs. While for sure a delayed response compared to agent based detection mechanisms, it's a big step for those workloads teams haven't gotten agents on for whatever reason.

Attack Surface management - expanding on a lot of the external validation Wiz already did by making it a bit more holistic, testing oriented, and covering on-prem and SaaS footprints.

SecOps and Issues Agents - the agent based approach to issues and allowing developers to create remediations via MCP is a big step in the right direction.

Wiz continues to innovate in a way that disrupts a lot of the traditional categories and tool siloes, and the flexibility of the graph data model at the heart of the product continues to allow rapid innovation.

James Berthoty

Founder & Analyst @ Latio | AWS Community Builder

These sorts of videos are my favorite to make - getting real product access and testing the tool, then talking about what makes it so special. When it comes to AI tools, it's rare that I get this kind of access, and it speaks to the maturity of Maze's solution that I was able to do this.

To put it simply, Maze does some really amazing stuff - automating the kind of manual nightmarish work I had to do going through FedRAMP. This is where I had to create auditable justifications for any time we were risk adjusting or marking a finding as a false positive. Maze takes a truly agentic approach at reducing the noise there, while prioritizing and deprioritizing across findings.

You can see the walkthrough here!
https://lnkd.in/eVCMzXNd

Open video: An Analyst's Review: Modern Vulnerability Management with AI that thinks like a Security Engineer on youtu.be

An Analyst's Review: Modern Vulnerability Management with AI that thinks like a Security Engineer

taplio

James Berthoty's Linkedin Analytics

James Berthoty

Performance ScoreJames Berthoty's LinkedIn Performance

James Berthoty's Best Posts (last 30 days)

Ready to grow your LinkedIn presence?

taplio

.css-6ytdur{background-image:linear-gradient(284deg, rgba(39, 43, 72, 1) 0%, rgba(33, 47, 183, 1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}James Berthoty's Linkedin Analytics

James Berthoty

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}James Berthoty's LinkedIn Performance

James Berthoty's Best Posts .css-1emoo84{font-size:var(--chakra-fontSizes-md);font-weight:400;color:var(--chakra-colors-gray-600);}(last 30 days)

Ready to grow your LinkedIn presence?

James Berthoty's Linkedin Analytics

Performance ScoreJames Berthoty's LinkedIn Performance

James Berthoty's Best Posts (last 30 days)