Santa Monica
AppSec SoCal
June 11 2025
Join us at Planet Cyber Sec AppSec SoCal, the must-attend conference for cybersecurity professionals, developers, and business leaders dedicated to advancing software security. This is your chance to connect with experts from around the globe and California’s dynamic information security community, all while exploring cutting-edge strategies to integrate security into agile development.
Dive into insightful discussions, gain practical knowledge, and network with top-tier professionals shaping the future of cybersecurity.
Set against the stunning backdrop of the Annenberg Community Beach House along the Pacific coast, AppSec SoCal offers the perfect environment to relax, collaborate, and even capture a few beachside moments. Don’t miss the opportunity to stay ahead of industry trends, learn from seasoned experts, and earn CPE credits.
Reserve your spot today and be part of the movement driving secure software development forward!
Wed, June 11, 2025
Registration, Breakfast at: 8:30 AM
Conference: 9:30 AM – 6:20 PM
Happy Hour: 6:10PM – 7:30 PM
The Annenberg Community Beach House,
Santa Monica, Ca
Get Directions
Day(s)
:
Hour(s)
:
Minute(s)
:
Second(s)
Featured Speakers
Keynote
Jim Manico
Founder, Manicode Security
Keynote
Dustin Lehr
Co-founder, Katilyst
Michael Wylie, MBA, CISSP
Author | Speaker | 4x CVEs | Threat Hunter | People Leader
Scott Bly
CISSP & CISM certified InfoSec Professional, Director of Security Technologies @ SIS, iSO
Chris Callas
CEO @ Arbure | Dad | CSA LA President | QSA | Hacker | Cloud Whisperer
Richard Greenberg
CEO, Layer 8 Masters
Neil Gerard
Advisory Manager, Application Security at Deloitte
Kyle Kelly
Senior Manager, Package Security at Github
Jerry Hoff
CEO at Maru Security
Mikhael Felker
Director of Product Security and Privacy Engineering at Verily Life Sciences
Ethan Morchy
Hardware/Software Penetration Tester at Somerset Recon
Jacob Combs
CISO at Tandem Diabetes Care, Inc
Uttej Badwane
Senior Security Engineer at Carta
Eran Medan
Co-Founder & CTO at Arnica
James Green
Co-Founder/Chief Product Officer at Heeler Security Inc.
Justin Ruth
Director of Solutions Engineering at Checkmarx
Jimmy Xu
Field CTO at Cycode
Chris Stensager
Solutions Architect at Imperva, a Thales Company
Sponsors, Orgs, Exhibitors
June 11 2025
8:15 AM - 9:15 AM
Registration & Breakfast & Networking
9:15 AM - 9:45 AM
Garden Terrace Room
Richard Greenberg
Ceo at Layer 8 Masters
Welcome Note
Welcome to the Planet Cyber Sec Conference. Join us in Room Garden Terrace for the Welcome Note to kickstart a day of insightful discussions and networking.
Get to Know Our Exhibitors & ORGs
As part of our commitment to supporting the broader cybersecurity community, we’ve invited non-profit organizations and exhibitors in the InfoSec space to take part in this year’s conference. During this session, each group will briefly introduce themselves, share their mission, activities, and how you can get involved. If you'd like to learn more, be sure to visit their booths throughout the day.
9:45 AM - 10:30 AM
Garden Terrace Room
Jim Manico
Founder, Manicode Security
Opening Keynote
Leveraging AI for Secure React Development with Effective Prompt Engineering
This keynote will give you practical and usable advice on how to harness the power of AI to create secure React applications by using prompt engineering best practices. We will discuss practical methods for guiding AI models to produce safe, high-quality React code that reduces common vulnerabilities, such as cross-site scripting (XSS) and injection flaws.
Attendees will learn foundational techniques for crafting precise prompts, incorporating secure coding patterns, and validating AI-generated outputs.
By the end of this session, you will be equipped with actionable steps to integrate AI-driven development into your workflow and strengthen the overall security of your React and other software projects.
10:30 AM - 10:50 AM
Break - Vendor Expo
10:50 AM - 11:30 AM
Garden Terrace Room
Mike Wylie
Author | Speaker | 4x CVEs | Threat Hunter | People Leader
Talk
From bank heist to IT Worker: Hunting DPRK in your network
This session will provide a deep dive into the threat posed by North Korean (DPRK) IT workers who infiltrate organizations worldwide, posing as legitimate remote employees. These individuals, often operating under the direction of the DPRK government, seek to generate revenue, steal intellectual property, and potentially establish long-term access for future malicious activities. This presentation will explore the tactics, techniques, and procedures (TTPs) used by DPRK IT workers, and how to hunt for these threats in your network.11:35 AM - 12:15 PM
Garden Terrace Room
Jerry Hoff
CEO at Maru Security
Talk
The AI Appsec Nightmare
The era of AI-powered attackers is no longer theoretical. Autonomous and semi-autonomous tools are now capable of identifying, exploiting, and adapting to vulnerabilities at a scale and speed that surpass human capacity. This talk explores the implications of a world where AI-driven threats are a permanent part of the landscape. We begin with a candid look at the current state of application security, where manual processes and outdated risk models struggle to keep pace with modern development. At the same time, AI-generated code is entering environments at an unprecedented rate, often with little to no review, expanding the attack surface in ways few organizations are prepared for. Compounding the problem is a growing wave of global regulations pushing organizations to demonstrate security readiness, often without providing practical paths to achieve it. Within this context, the traditional approach of prioritizing and fixing only critical and high-severity issues is breaking down. Attackers, especially those leveraging AI, no longer view low or medium vulnerabilities as difficult hurdles. Most vulnerabilities should now be treated as easily exploitable. This session offers a sharp, forward-looking assessment of the challenges ahead and outlines key shifts that application security teams must make to stay relevant and effective in the age of AI.12:15 PM - 1:30 PM
Lunch - Vendor Expo
1:30 PM - 2:10 PM
Garden Terrace Room
Scott Bly
CISSP & CISM certified InfoSec Professional, Director of Security Technologies @ SIS, iSO
Talk
Adding API Security to your DevSecOps Toolbelt
How do you integrate API Security into your DevSecOps processes? You have DevOps tooling and CI/CD pipelines for your product release cycle. Your Dev & Ops teams work well together. You started a DevSecOps transformation to Shift Left and test code security in pipelines.
But how do you integrate the Security teams into DevOps to achieve true DevSecOps? Then, how do you integrate APIs, as they are behavior-based? Traditional AppSec can’t identify vulnerabilities in API consumption.
Learn how to integrate API testing into Shift Left DevSecOps pipelines to eliminate vulnerabilities. Learn how to bring Dev, Sec, Ops teams together to improve Mean Time To Remediation, and keep your teams happy!
2:15 PM - 2:55 PM
Garden Terrace Room
Neil Gerard
Advisory Manager, Application Security at Deloitte
Talk
From Breach to Blueprint: Building a Resilient API Security Framework
The API Security space is maturing; once niche solutions are now being acquired by the major cyber vendors, and advanced security capabilities are being folded into API infrastructure. Many organizations are now developing API-specific security policy, and focusing audits exclusively around their API governance and security. In this presentation, we dive deep into what has (and has not) worked over the past few years when it comes to API Security strategies. We’ll look at some of the major API breaches over the last years and cross-compare these with the OWASP API Top 10 framework. We’ll also look at the capabilities touted by API Security vendors to understand which ones really matter, and which are just more ‘bells and whistles’. Finally, we’ll offer a comprehensive, tool-agnostic security framework that can be leveraged by organizations to incorporate API security across the many business functions it must bridge to be effective.3:00 PM - 3:20 PM
Garden Terrace Room
Chris Stensager
Solution Architect at Imperva, a Thales Company
Lightning Talk
Securing Your Revenue Stream: Protecting Applications and APIs from Bot Threats
With automation changing the landscape, global cyber losses now average between $68-$116B annually. In this overview, we’ll review the scope of the challenge based upon Imperva’s data and provide practical steps you can take to prepare for the inevitable security incident.
3:20 PM - 3:40 PM
Break - Vendor Expo
3:40 PM - 4:20 PM
Garden Terrace Room
Ethan Morchy
Hardware/Software Penetration Tester at Somerset Recon
Talk
Automated Bug Bounty Hunting with Semgrep
This talk will cover a variety of techniques that can be leveraged to automatically identify and fix vulnerabilities in source code and firmware. Throughout the talk, a static analysis tool called Semgrep will be used to automate bug vulnerability analysis. A variety of techniques will be presented with a focus on custom Semgrep rule creation, how to find 0-day vulnerabilities, and how to quickly triage static analysis results. Lastly, the talk will debut a custom tool integrating Semgrep to identify public, open-source vulnerabilities.4:25 PM - 5:05 PM
Garden Terrace Room
Mikhael Felker
Director of Product Security and Privacy Engineering at Verily Life Sciences
Talk
The Great Security Reset: Scaling Privacy & Compliance After Splitting from a Parent Company
The Great Security Reset: Scaling Privacy & Compliance After Splitting from a Parent Company
A corporate spin-off is a rare opportunity to reimagine security from the ground up—but it also comes with significant risks. This session will explore the unique challenges of separating from a parent company while ensuring continuity in compliance, privacy, and security operations.
We’ll discuss how to design an effective security and privacy engineering team, create a hiring and retention strategy, and integrate security into product development.
Attendees will leave with a blueprint for building a security program that not only satisfies legacy obligations but also sets the stage for future innovation and scalability in the life sciences and insurance industries.
5:10 PM - 5:30 PM
Garden Terrace Room
Jimmy Xu
Field CTO at Cycode
Talk
Future-Proofing Your Application Security for 2025 and Beyond
Software development has undergone seismic shifts over the last 20 years: the Agile movement, the rise of DevOps and cloud native practices, and now the AI and generative development era. With AI code assistants and “vibe coding” on the rise, we’re seeing faster delivery—along with new and complex risks. Over the last 10 years of DevSecOps journey, shift-left also achieved little success. Application Security needs a fundamental reset for the future. In this talk, we will discuss how modern approaches and technology innovations are built to solve three of the biggest challenges in application security that must evolve for the AI Era – Speed, Coverage & Scale, and Context. We will explore three common scenarios: (1) Inventory and Secure net new applications, (2) Reduce risk and volume of existing security backlog by prioritizing and fixing what matters, and (3) Expand coverage to address emerging blind spots in modern software supply chain.
5:30 PM - 5:45 PM
Break - Vendor Expo
5:45 PM - 6:30 PM
Garden Terrace Room
Dustin Lehr
Co-founder, Katilyst
Closing Keynote
From Soft Skills to Hard Data: Measuring Success of Security Champions and Culture Change
Security leaders know that culture matters. But proving it? That’s where things get tricky.
We invest in developer training, launch security champion programs, and encourage developers to proactively engage early in the lifecycle. Yet, when the CISO or even the CEO asks, “Is it working?”—many teams struggle to answer with anything beyond anecdotes.
To move from assumptions to evidence, we need to embrace the power of storytelling backed by data. One story might start with a lone developer raising a hand about a risky pattern—and lead to systemic change across dozens of teams. But how do you measure that kind of cultural ripple effect?
In this talk, I’ll share how to move from soft skills to hard data by measuring the real impact of your security culture efforts. While surveys can offer helpful signals, they often fall short—what people say they want, what they think they want, and how they actually behave are sometimes not the same. That’s why this talk focuses on observable actions and meaningful patterns, not just perceptions. Drawing from years of building proactive security programs and champion networks across multiple industries, I’ll walk through:
- What to measure (and what not to) when it comes to security champions and cultural influence.
- How to track meaningful behaviors, not just checkboxes—from threat modeling to early vulnerability reporting and secure design reviews initiated by devs.
- Measuring actual actions taken by champions and developers—not just attendance or passive engagement.
- Signals of relationship strength—like organic collaboration, security feedback loops, and internal referrals.
- How to measure correlation when causation is difficult, including before-and-after snapshots, A/B testing, and behavioral baselining.
- Creative ways to connect your data to ROI, like reduced incident rates, faster time-to-remediate, earlier security involvement, more reported issues, fewer late-stage disruptions, and increased developer ownership.
- How to demonstrate behavior progress through metrics, so your champions aren’t just inspired—they’re shown to be measurably making a difference
You’ll leave with a practical framework and real-world examples for telling a compelling story about your program’s impact—one that resonates with your participants and the executive suite.
Key Takeaway: You can’t improve what you can’t measure—but with the right metrics and stories, you can prove that culture change isn’t just possible, it’s powerful.
6:30 PM - 6:35 PM
Garden Terrace Room
Haral Tsitsivas
Chief Information Officer at Layer 8 Masters
Closing Remarks
6:35 PM - 8:00 PM
Happy Hour and Raffle Drawing
8:15 AM - 9:15 AM
Registration & Networking
10:30 AM - 10:50 AM
Break - Vendor Expo
10:50 AM - 11:30 AM
Club Room
Jacob Combs
CISO at Tandem Diabetes Care, Inc.
Talk
The Future of Product Security: AI, Quantum Computing, and the Evolving Threat Landscape
The rapid evolution of AI and Quantum Computing is reshaping the security landscape, challenging traditional models, and demanding a paradigm shift in product security. AI is a double-edged sword, empowering defenders while simultaneously enhancing attackers’ ability to automate, evade detection, and steal sensitive data. Quantum Computing, on the other hand, threatens to break modern cryptographic standards, requiring proactive preparation to secure the future. This session will provide practical insights and a roadmap to help security leaders leverage AI for defense, mitigate emerging AI risks, and transition toward quantum-resistant architectures before threats become reality.11:35 AM - 12:15 PM
Club Room
Chris Callas
Talk
Beyond the Checklist Series: Using Local LLMs to Prepare for Future Security Requirements
As organizations gear up for PCI DSS 4.0.1 compliance, security teams are faced with the challenge of adapting to future-dated controls that take effect on March 31, 2025. Instead of scrambling to overhaul infrastructure, we’ll demonstrate how local LLMs can be used to intelligently assess security requirements, map them to existing Terraform configurations, and identify areas for proactive improvement. In this session, we use Fabric with a local LLM (Ollama + localLLM of choice) to extract future-dated PCI DSS 4.0.1 controls and analyze our Terraform configurations. By leveraging machine reasoning, we’ll automate the mapping of compliance requirements to infrastructure, pinpoint security gaps, and determine where to focus efforts for compliance readiness. We’ll then enforce security policies in Terraform using Open Policy Agent (OPA) to prevent misconfigurations before they happen.12:15 PM - 1:30 PM
Lunch - Vendor Expo
1:30 PM - 2:10 PM
Club Room
Uttej Badwane
Senior Security Engineer at Carta
Talk
Scaling Cloud Security Program - Learnings & Best Practices
Cloud security isn’t just about adding more tools—it’s about making the right decisions early and often. In this session, we’ll dive into hard-earned lessons from building and scaling a cloud security program, covering key identity, infrastructure, and automation challenges that every DevSecOps team faces. I will share my learnings as an hands-on engineering approach from building cloud security in Silicon Valley hyper growth tech companies!
Few key takeaways -
IAM Users vs. IAM Roles – The identity mistakes you don’t want to make
Cloud Identity & Zero Trust – Rethinking access
Infrastructure as Code (IaC) – Security pitfalls and best practices
Clean Container Images – Avoiding hidden vulnerabilities before they hit production
Cloud Security Scanners – The good, the bad, and the false positives
This is based on real-world successes and failures. Expect practical strategies, battle-tested best practices, and stories from the trenches that will help you level up your cloud security game.
2:15 PM - 2:55 PM
Club Room
Eran Medan
Co-Founder & CTO at Arnica
Talk
Smarter Security, Faster Code: How Risk Mitigation Tools Empower Developers
Developers are not security experts, yet they are expected to write secure code. This talk will explore how modern security tools can provide risk mitigation assistance directly to developers, helping them identify and fix vulnerabilities in real time. The speaker will discuss how AI-driven security suggestions, pre-PR risk detection, and automated remediation guidance can enable developers—especially junior engineers—to understand and resolve security issues without slowing down their workflow. Additionally, the session will emphasize the importance of identifying security risks before pull requests (PRs) are even created, shifting security left in a way that enhances both efficiency and security. Attendees will leave with a clear understanding of how to leverage security tools to make secure coding easier and more intuitive. Developers will learn how they can use security feedback to improve their coding skills without feeling overwhelmed, while AppSec leaders will discover how to provide support that enhances developer productivity rather than hindering it. By integrating risk mitigation assistance into the development process, teams can significantly reduce vulnerabilities while maintaining high development speed and agility.3:00 PM - 3:20 PM
Club Room
Justin Ruth
Director of Solutions Engineering at Checkmarx
Lightning Talk
The 5 Fabulous Foundations of Application Security
Application security often brings to mind complex tools and endless vulnerability lists. This presentation will introduce the "5 Fabulous Foundations of Application Security," a pragmatic framework designed to streamline the process of preventing, finding, and fixing vulnerabilities. We'll explore how a strategic approach to these foundations can dramatically improve developer engagement and overall security posture
3:20 PM - 3:40 PM
Break - Vendor Expo
3:40 PM - 4:20 PM
Club Room
James Green
Co-Founder/Chief Product Officer at Heeler Security Inc.
Talk
Context is King: Scaling AppSec Through Runtime Threat Modeling
Application security teams are drowning in findings from a sprawl of disconnected tools and a lack of context. As both threats and development accelerate—from cloud-native architectures to agentic systems—the ratio of code to developer is expanding exponentially. But the ratio of AppSec engineers to developers isn’t keeping pace, leaving security teams overwhelmed and eroding customer trust. It’s time to change the model: instead of starting with findings, we must start with the application. Vulnerabilities are just one signal—without deep application context, they're noise. Runtime threat modeling enables teams to understand how applications actually behave in production: what code is reachable, which services communicate, what data is exposed, and where trust boundaries are violated. In this talk, we’ll demonstrate how runtime-aware threat modeling can surface exploitable risks that traditional approaches miss, eliminate false positives, and bridge the gap between AppSec and engineering. We'll walk through real-world examples of how modeling helps prioritize what truly matters—and why this shift is essential for scaling application security.4:25 PM - 5:05 PM
Club Room
Kyle Kelly
Senior Manager, Package Security at Github
Talk
Software Supply Chain Security: Implicit Trust Will Get You Pwned
In today's software development landscape, code is often created, stored, built, and deployed across different environments, leading to significant security risks. This talk will explore the risks of our historical implicit trust model and the industry's evolving response. We will focus on software package vulnerabilities, the threat of malicious packages, and the role of attestations in enhancing security.6:35 PM - 8:00 PM
Happy Hour and Raffle Drawing
Richard Greenberg, CISSP is a well-known Cyber Security Leader and Evangelist, CISO, Advisor, and speaker.
Richard brings over 30 years of management experience and has been a strategic and thought leader in IT and Information Security. His Project Management, Security Management and Operations, Policy, and Compliance experience has helped shape his broad perspective on creating and implementing Information Security Programs.
Richard has been a Chief Information Security Officer (CISO) for 15 years, Director of Surveillance and Information Systems, Chief of Security Operations, Director of IT, and Project Manager for various companies and agencies in the private and public sectors.
You may have heard Richard’s interview as a Cyber Security expert on Will Ferrell’s Ron Burgundy podcast: https://www.iheart.com/podcast/the-ron-burgundy-podcast-30270227/episode/cyber-security-47951911/.
Richard is the Founder and CEO of Security Advisors LLC, which offers fully-managed security assessments and network and software penetration testing services that allows organizations to continuously assess their internal and external cyber risk posture, and helps companies with compliance issues. He is also the CEO of Layer 8 Masters, which has been putting on the content-rich Planet Cyber Sec conferences and CISO-CIO Forums.
Richard is an Information Systems Security Association (ISSA) Distinguished Fellow, one of only 64 worldwide, and has received their Honor Roll designation (only 55 worldwide). He has also been selected as a finalist for both the (ISC)2 Americas Information Security Leadership Award in the Senior Information Security Professional category and the Los Angeles Business Journal CIO of the Year in Security.
Richard has served on the OWASP Global Board of Directors, leads the OWASP LA Chapter, and has been Co-Chair of the highly successful AppSec California conferences. Richard also is President of the Information Systems Security Association Los Angeles Chapter and is Chair of their widely recognized annual Security Summit and CISO Forum.
Richard is dedicated to diversity in our field. He started and chairs the annual Women in Security Forum, and supports creating a more open and welcome community. Richard’s reach in the Southern California region is extensive. He has worked diligently to bring together the various Southern California IT and InfoSec organizations to enhance their collaboration efforts, to help reach new IT and InfoSec professionals.
Richard has been a published author and has spoken worldwide on Information Security, individually and on panels.
Haral Tsitsivas is a cybersecurity leader and software developer with 40+ years of IT and software development and 20+ years of systems and software security experience, specializing in threat modeling, product security reviews and assessments.
Haral was an Orange County OWASP chapter leader, served on the board of the OWASP Outreach Committee and was the Vice-Chair of the OWASP Chapter Committee.
Jim Manico
Jim Manico is the Founder of Manicode Security, a company dedicated to providing expert training in secure coding and security engineering to software developers. In addition to leading Manicode, Jim is actively involved in the tech startup ecosystem as an investor and advisor. His portfolio includes notable companies such as SemGrep, EdgeScan, Nucleus Security, Defect Dojo, RAD Security, Akto, Inspectiv, Levo.ai and Phoenix Security. Also, he is a fund-limited investor with Aviso Ventures, bringing his knowledge of software security to the venture capital domain. Jim is a recognized figure in the software development community, particularly known for his contributions to secure software practices. He holds the title of a Java Champion, acknowledging his contributions to the Java community. He is also the author of “Iron-Clad Java: Building Secure Web Applications”, published by Oracle Press. Jim is committed to giving back to the community through his volunteer work with the OWASP foundation. He co-leads projects such as the OWASP Application Security Verification Standard (ASVS) and the OWASP Cheatsheet Series, contributing significantly to the field of web application security.
For more information, please visit his LinkedIn profile at https://www.linkedin.com/in/jmanico or visit him on @manicode.
Mike Wylie
Michael Wylie, MBA, CISSP is the leader of a global managed threat hunting team, bringing expertise in strategic threat hunting to the table. As the former Director of Threat Hunting at CrowdStrike and the Director of Cybersecurity Services at a top 100 accounting firm, he spearheaded the development and growth of DFIR and Threat Hunting. With extensive experience teaching and training, Michael has delivered courses for elite organizations, including the U.S. Department of Defense, LinkedIn Learning, DEFCON, Moorpark College, California State Universities, and numerous clients worldwide.
Dustin Lehr
Dustin Lehr is an accomplished software engineer turned executive cybersecurity leader with a passion for people-focused security culture change, proactive security practices, and developer enablement.
Dustin is the Co-founder and Chief Product and Technology Officer of Katilyst (https://www.katilyst.com/), which helps companies build engaging and effective security champion programs. He is the driving force behind the Security Champion Program Success Guide (https://securitychampionsuccessguide.org/) and a recognized thought leader in applying behavioral science and change management principles to application security, fostering productive partnerships between developers and security teams.
As a frequent speaker and advocate for security collaboration, Dustin co-founded the “Let’s Talk Software Security” discussion community (https://www.meetup.com/lets-talk-software-security/), fostering open conversations on the challenges and opportunities in modern application security.
Scott Bly
Scott Bly is the Director of the API Security Practice at Systems Integration Solutions where he leads customer DevSecOps transformations through an API-first journey of cyber maturity and continual improvement.
Scott has served as a Cybersecurity Technical Account Manager (TAM) at Noname Security, and he led teams of TAMs at AWS where he ran the Enterprise Support Security Improvement Program, which has assisted thousands of customers to measure and improve their cloud security postures.
Scott’s background as a film production major at USC and longtime IT Consultant was the perfect fit during his tenure as the Director of IT for the American Film Institute, where he led their digital transformation and migration to the cloud.
Scott has served as a Cybersecurity Solutions Architect and holds more than 50 certifications in IT and security, including CISSP and CISM, and from vendors such as Fortinet, Cisco and AWS.
Scott lives in Santa Monica with his wife, son, and two cats.
As the Principal at Arbure, Christopher plays a crucial role in the organization’s strategic and tactical endeavors. Leveraging vast experience, Christopher has been instrumental in carving a niche for Arbure in the competitive landscape of Information Security. Christopher holds responsibility for the development and delivery of consulting services, tailored to address the unique needs and challenges of each client. This involves a deep understanding of the cybersecurity landscape, the ability to anticipate and respond to evolving threats, and the capacity to articulate complex strategies into actionable steps. As the primary delivery resource, Christopher is hands-on with every project undertaken by the firm. Working closely with clients to ensure the successful execution of all strategic and tactical objectives, driving the project to its intended goals while maintaining a vigilant eye on quality and efficiency.
With more than a decade of experience in the information security domain, Christopher brings a wealth of knowledge and a track record of success to his current role as Principal at Arbure. Christopher’s deep-seated background in cloud security is a testament to his comprehensive technical prowess. This expertise, honed over years of hands-on experience, now guides Arbure’s clients through the complexities of securing their cloud infrastructures.
Christopher studied Computational Economics at the University of California Santa Barbara. His current certifications include Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Qualified Security Assessor (QSA). He held prestigious industry certifications, Payment Application-Qualified Security Assessor (PA-QSA), QSA for Point-to-Point Encryption (QSA P2PE), and PA-QSA for Point-to-Point Encryption (PA-QSA P2PE). These accreditations underscore Christopher’s capability to navigate clients through the challenging landscape of compliance in information security.
Neil Gerard
Neil Gerard, CISSP is an application security professional with over 18 years of experience across software engineering, product security, DevSecOps, and vulnerability management. He holds a bachelor’s degree in Computer Science and a master’s degree in Cybersecurity.
Neil began his career in computer science and software development, with a focus towards developing information security systems and leading small teams of software developers and systems engineers. He spent over a decade as a software engineer for a boutique email security company leading product security and gained experience in vulnerability management, secure development practices, security architecture, data protection, PKI, and encryption/digital signatures.
Currently serving an Advisory Manager in Deloitte’s Cyber Risk services in their DevSecOps practice, Neil has advised several Fortune 100 organizations across multiple cyber domains. Recent projects include conducting software assurance maturity assessments, developing software vulnerability prioritization and remediation frameworks, building out secure SDLC policy, developing API Security policy and technical standards, assessing and improving their API security programs.
Neil lives in Oceanside, CA with his wife and three kids and enjoys spending time with his family and surfing.
Kyle Kelly is the Manager of GitHub’s Package Security Team and the author of the CramHacks newsletter and blog.
He is passionate about leveraging his security expertise to address today’s and tomorrow’s software supply chain security challenges, particularly in relation to open-source software.
Before focusing on software supply chain security, Kyle led a team of penetration testers specializing in hacking financial institutions.
Jerry Hoff
Jerry Hoff has decades of experience in technology and security, specializing in application security at an enterprise scale. He holds a Master’s in Computer Science from Washington University in St. Louis and has evaluated the security of applications for some of the largest financial, defense, and commercial organizations in the world. His work has provided deep insight into the evolving threat landscape and the challenges organizations face in securing complex software systems.
As a security entrepreneur, Jerry founded and led a static application security testing startup, which was acquired by WhiteHat Security in 2011. He has been an active member of the security community for nearly twenty years as a lifetime member and long-time volunteer with OWASP.
Jerry has held key leadership roles in global organizations, including serving as the Global Head of Security for Sony Electronics and as a Group Senior Security Architect for NTT. His expertise spans secure software development, application security strategy, and enterprise security architecture.
He now leads Maru Security, a company dedicated to training organizations on secure software development. Maru Security provides developers with up-to-date, code-level security training across a wide range of programming languages. By focusing on practical, hands-on education, Maru Security helps teams integrate robust security practices into their development workflows, ensuring that secure coding becomes a fundamental part of the software development lifecycle.
Jacob Combs
Jacob Combs is a seasoned CISO and product security leader with extensive expertise in medical device security, regulatory compliance, and AI-driven cybersecurity solutions. With a background spanning telecommunications, defense, healthcare, financial services, and manufacturing, he has built and led security programs that balance innovation, risk management, and regulatory alignment. He is also the founder of a cybersecurity advisory firm and a recognized thought leader in product security, AI governance, and quantum-resistant architectures.
Mikhael Felker is head of security & privacy engineering at Verily Life Sciences and has over 15 years of security, privacy, risk and compliance experience working at both startups and several Fortune 500 companies.
Felker received his M.S. in information security policy and management from Carnegie Mellon University and B.S. in computer science from UCLA. His written work of 50+ publications has been featured in Forbes, ACM, IEEE Security & Privacy, ISACA Journal, ISSA Journal, podcasts, case studies and a number of online magazines.
Ethan Morchy is a cybersecurity professional at Somerset Recon. His areas of interest include cryptography, lockpicking, vulnerability research, digital forensics, embedded security, and Capture the Flag (CTF) competitions.
Uttej Badwane is a seasoned cybersecurity expert with nearly a decade of experience securing cloud environments and driving corporate security initiatives for hyper-growth corporations in Silicon Valley. As a Senior Security Engineer at Carta, he plays a key role in safeguarding cloud infrastructure at scale, implementing Zero Trust architectures, securing containerized workloads, and managing vulnerabilities to protect sensitive assets.
Passionate about building resilient cloud security frameworks, Uttej specializes in designing scalable, automated security solutions that align with modern cloud-native environments. His expertise spans identity and access management (IAM), infrastructure as code (IaC) security, and cloud-native threat detection.
Beyond his technical work, Uttej is dedicated to mentoring the next generation of cybersecurity professionals and actively contributes to security communities and initiatives that advance the field.
Eran Medan
Eran Medan is a highly experienced professional who has worked in various roles in the tech industry. With a background in Computer Science and Information Systems, Eran has held positions such as Co-Founder and CTO at Arnica, Software Development Manager at Amazon Web Services (AWS), and Software Engineering Manager at NICE Actimize. Eran has expertise in areas such as software development, security consulting, and team management. With a Master’s degree in Computer Science from Georgia Institute of Technology, Eran continues to excel in the tech field.
James is Co-Founder, Chief Product Officer, and Board Member of Heeler where he is working to revolutionize application security with unified code, runtime and business context. He is obsessed with building security products that solve unmet needs and deliver amazing experiences.
James has successfully launched and expanded multiple SaaS security products, collectively reaching over $400 million in annual revenue. These products achieved 90% operating margins and a Net Promoter Score (NPS) of 65+, reflecting their high quality and customer satisfaction. He has successfully managed P&L, guiding the organization through IPO preparation and execution, all while expanding engineering capacity and aligning R&D spending to meet public offering expectations.
James is a passionate, customer-driven leader with extensive experience in growing and scaling high-performing, customer-focused product teams. With expertise in leading large engineering organizations of 300+ professionals across the globe, he excels in integrating both large and small acquired entities, having helped execute 9 acquisitions totaling $500+ million.
Justin Ruth is the Director of Solution Engineering at Checkmarx, where he and his team help organizations build scalable application security programs by bridging the gap between development and security. Justin brings a practical background in implementing application security tooling across various aspects of the software development life cycle and helps leaders demonstrate the ROI of a successful application security program. An Offensive Security Certified Professional, Justin focuses on the exploitation of vulnerabilities to highlight the impact flaws can have on a business. He frequently speaks at conferences on emerging threats, such as the impact of generative AI on malicious code in software supply chains and participates in bug bounty programs.
Jimmy Xu is the Field CTO at Cycode. He is an innovative, forward-thinking, and reputable technology leader with over 21 years of combined experience in software engineering, IT Ops & DevOps, and cybersecurity across both public and private sector. Jimmy has worked as a practitioner across multiple roles in the US Department of Defense, Consulting leader and Solutions Architect for multiple IT systems integrators & consultancy across a broad range of technologies specializing in Application Security, API Security, and Cloud Security. Most recently, Jimmy was leading the DevSecOps and Cloud Security practice at Trace3, a well-known US-based consultancy and systems integrator servicing fortunate 100 clients focused on helping customers transform their DevSecOps program, cloud native adoption, select the best technology solutions, implement and operationalize them. Jimmy had personally led numerous successful DevSecOps transformations and built several innovation solutions that enabled modern DevSecOps patterns. Jimmy has also been a technology advisor for Research Analysts, VCs, and a number of cybersecurity companies as an advisory member.
Chris is a Solution Architect at Imperva, a Thales Company, a leading provider of Application, API, and Data Security solutions.
For the past 8 years Chris has been at the forefront of helping customers address Application Security threats for business of all sizes.
As Solution Architect Chris is currently involved with enabling teams, assisting in strategic sales opportunities and guiding Product Development teams in meaningful product innovations at Imperva.