Reddit’s Matt Johansen on renouncing superhero culture and what comes next after “shift left”
04/02/24 • 56 min
In this week’s episode of The Future of Security Operations podcast, Thomas is joined by Matt Johansen. Matt is a security veteran who has helped defend startups, the biggest financial companies in the world, and everything in between. Alongside his day job as Head of Software Security at Reddit, he teaches companies how to protect against cyber attacks, and coaches entrepreneurs and CISOs that need help with infrastructure, application, cloud, and security policies. He also writes Vulnerable U, a weekly newsletter that talks about embracing the power of vulnerability for growth.
Thomas and Matt discuss:
Moving from a large security team at Bank of America to a small one at Reddit
Embracing scrappiness and doing more with less
Overcoming sunk-cost fallacy
Why the 2014 Sony hack was a pivotal time for AppSec
Running the threat research centre at White Hat
What he looks for when hiring in AppSec, the SOC and beyond
His decision to start creating content about mental health in security
Moving past imposter syndrome
Renouncing superhero culture
Paved paths and guardrails, and what comes next after "shift left"
Lessons learned from Reddit's 2023 security incident
The power of automating incident response
The Future of Security Operations is brought to you by Tines, the smart, secure workflow builder that powers some of the world’s most important workflows. https://www.tines.com/solutions/security
Where to find Matt Johansen:
Vulnerable U newsletter: https://vulnu.mattjay.com/
Twitter: https://twitter.com/mattjay
LinkedIn: https://www.linkedin.com/in/matthewjohansen/
TikTok: https://www.tiktok.com/@vulnerable_matt
Reddit: https://www.redditinc.com/
mattjay.com: https://www.mattjay.com
Where to find Thomas Kinsella:
Twitter/X: https://twitter.com/thomasksec
LinkedIn: https://www.linkedin.com/in/thomas-kinsella/
Tines: https://www.tines.com/
Resources mentioned:
The Tech Professional's Guide to Mindfulness by Matt Johansen: https://www.mattjay.com/blog/the-tech-professionals-guide-to-mindfulness
Matt's piece on developer experience in the Vulnerable U newsletter: https://vulnu.mattjay.com/p/vulnu-003-courage-quit
Reddit's post on a February 2023 incident: https://www.reddit.com/r/reddit/comments/10y427y/we_had_a_security_incident_heres_what_we_know/
Collaborative Incident Response Best Practices: Don't Rely on Superheroes by Matt Johansen: https://www.mattjay.com/blog/superhero-incident-response
Threat modeling depression by Matt Johansen: https://www.mattjay.com/blog/threat-model-depression
In this episode:
[02:14] Going from long-time Reddit user to employee
[04:50] Running AppSec at Reddit
[07:30] Being the internet's punching bag and boxing gloves
[10:30] Building a team from scratch at White Hat and lessons learned from the 2014 Sony hack
[15:10] Matt's approach to hiring
[21:15] His decision to create content about mental health in security
[23:20] Turning his Twitter network into his IRL network
[27:55] Moving past imposter syndrome
[30:00] Tools for safeguarding your mental health in incident response
[36:20] Preserving work-life balance for his teams at Reddit
[39:15] Moving past "shift left", and paved path to production and guardrails
[47:40] Lessons learned from a February 2023 incident at Reddit
[51:20] Renouncing superhero culture
[52:20] Automating incident response
[54:12] Connect with Matt
In this week’s episode of The Future of Security Operations podcast, Thomas is joined by Matt Johansen. Matt is a security veteran who has helped defend startups, the biggest financial companies in the world, and everything in between. Alongside his day job as Head of Software Security at Reddit, he teaches companies how to protect against cyber attacks, and coaches entrepreneurs and CISOs that need help with infrastructure, application, cloud, and security policies. He also writes Vulnerable U, a weekly newsletter that talks about embracing the power of vulnerability for growth.
Thomas and Matt discuss:
Moving from a large security team at Bank of America to a small one at Reddit
Embracing scrappiness and doing more with less
Overcoming sunk-cost fallacy
Why the 2014 Sony hack was a pivotal time for AppSec
Running the threat research centre at White Hat
What he looks for when hiring in AppSec, the SOC and beyond
His decision to start creating content about mental health in security
Moving past imposter syndrome
Renouncing superhero culture
Paved paths and guardrails, and what comes next after "shift left"
Lessons learned from Reddit's 2023 security incident
The power of automating incident response
The Future of Security Operations is brought to you by Tines, the smart, secure workflow builder that powers some of the world’s most important workflows. https://www.tines.com/solutions/security
Where to find Matt Johansen:
Vulnerable U newsletter: https://vulnu.mattjay.com/
Twitter: https://twitter.com/mattjay
LinkedIn: https://www.linkedin.com/in/matthewjohansen/
TikTok: https://www.tiktok.com/@vulnerable_matt
Reddit: https://www.redditinc.com/
mattjay.com: https://www.mattjay.com
Where to find Thomas Kinsella:
Twitter/X: https://twitter.com/thomasksec
LinkedIn: https://www.linkedin.com/in/thomas-kinsella/
Tines: https://www.tines.com/
Resources mentioned:
The Tech Professional's Guide to Mindfulness by Matt Johansen: https://www.mattjay.com/blog/the-tech-professionals-guide-to-mindfulness
Matt's piece on developer experience in the Vulnerable U newsletter: https://vulnu.mattjay.com/p/vulnu-003-courage-quit
Reddit's post on a February 2023 incident: https://www.reddit.com/r/reddit/comments/10y427y/we_had_a_security_incident_heres_what_we_know/
Collaborative Incident Response Best Practices: Don't Rely on Superheroes by Matt Johansen: https://www.mattjay.com/blog/superhero-incident-response
Threat modeling depression by Matt Johansen: https://www.mattjay.com/blog/threat-model-depression
In this episode:
[02:14] Going from long-time Reddit user to employee
[04:50] Running AppSec at Reddit
[07:30] Being the internet's punching bag and boxing gloves
[10:30] Building a team from scratch at White Hat and lessons learned from the 2014 Sony hack
[15:10] Matt's approach to hiring
[21:15] His decision to create content about mental health in security
[23:20] Turning his Twitter network into his IRL network
[27:55] Moving past imposter syndrome
[30:00] Tools for safeguarding your mental health in incident response
[36:20] Preserving work-life balance for his teams at Reddit
[39:15] Moving past "shift left", and paved path to production and guardrails
[47:40] Lessons learned from a February 2023 incident at Reddit
[51:20] Renouncing superhero culture
[52:20] Automating incident response
[54:12] Connect with Matt
Previous Episode
Twilio's Prima Virani on democratizing security and tackling burnout through automation
This week on The Future of Security Operations podcast, Thomas is joined by Prima Virani. Prima is a security engineer who worked across industries as varied as oil and gas and Fintech before becoming Principal Security Engineer at Twilio. With over a decade of experience spanning infrastructure security engineering, incident detection and response, and forensics, she's also shared insights at countless security conferences around the world, including SecTOR Canada and Agile India.
In this episode, Prima and Thomas discuss:
The unique challenges of working in forensics
Her transition to detection and response and cloud security
Building a security detection framework at Segment
Reducing mean time to resolve through automation
Using data to prioritize which processes should be automated
Merging teams and technologies when Segment was acquired by Twilio
Joining the securing platform engineering team at Twilio
Designing a challenging and varied career in security
The influence of mentorship on career growth
Democratizing security through knowledge sharing
How security will change in the next five years
The Future of Security Operations is brought to you by Tines, the smart, secure workflow builder that powers some of the world’s most important workflows. https://www.tines.com/solutions/security
Where to find Prima Virani:
Twitter: https://twitter.com/secnerdette?lang=en
LinkedIn: https://www.linkedin.com/in/primavirani/
Twilio: https://www.twilio.com/en-us
Where to find Thomas Kinsella:
Twitter/X: https://twitter.com/thomasksec
LinkedIn: https://www.linkedin.com/in/thomas-kinsella/
Resources mentioned:
Hosting Fleet on AWS EKS by Prima Virani: https://segment.com/blog/hosting-fleetdm-on-aws-eks/
Fleet Device Management: https://fleetdm.com/
In this episode:
[02:22] Prima's introduction to cybersecurity career opportunities as a teenager
[06:30] The shift from forensics to detection and response
[09:15] Gaining experience in vulnerability and patch management, and network security
[14:15] Building a security detection framework at Segment using SOCless
[18:10] Using automation to reduce alert noise and improve response times
[20:30] The impact of automation on security team burnout
[22:50] Merging security teams, practices and technologies during Twilio's acquisition of Segment
[25:30] Moving to the securing platform engineering team at Twilio
[27:40] Growing her knowledge of AWS, Kubernetes and GCP
[32:40] Prima's plans to embrace machine learning in detection engineering
[34:20] The importance of mentorship and knowledge sharing in career growth
[37:30] Prima's all-time favorite projects, including hosting FleetDM on AWS EKS
[39:36] The future of security operations through Prima's eyes
[42:01] Prima's advice for security practitioners
[43:58] Connect with Prima
Next Episode
Barracuda's Adam Khan on AI-driven XDR and plugging the cybersecurity skills gap
In this week’s episode of The Future of Security Operations podcast, Thomas is joined by Adam Khan. Adam is a cybersecurity and technology leader with over 25 years of experience working at Fortune 500 companies. He has a proven track record of building and managing global security teams, leading engineering, infrastructure, application, and product, and is currently VP of Global Security Operations at Barracuda.
Adam and Thomas discuss:
Building discipline and resilience by working on SRE teams
How a well-known DDoS attack changed his career path
Using automation to reduce alert fatigue
Strategies for plugging the security skills gap
The potential of AI-driven XDR
How cyber attacks are evolving in the age of AI
Lessons learned from researching the history of cybersecurity
Empowering teams to do their best work
Creating a culture of continuous learning
The Future of Security Operations is brought to you by Tines, the smart, secure workflow builder that powers some of the world’s most important workflows. https://www.tines.com/solutions/security
Where to find Adam Khan:
Adam's website: https://www.adamkhancyber.com/
LinkedIn: https://www.linkedin.com/in/adamkhan-cyber/
Barracuda: https://www.barracudamsp.com/ and [email protected]
Where to find Thomas Kinsella:
Twitter/X: https://twitter.com/thomasksec
LinkedIn: https://www.linkedin.com/in/thomas-kinsella/
Tines: https://www.tines.com/
Resources mentioned:
2023 Global Cyber Threat Report by Adam Khan: https://www.adamkhancyber.com/post/2023-global-cyber-threat-report
Adam's five-part cybersecurity history series on smartermsp.com: https://smartermsp.com/author/akhan/
DarkReading: https://www.darkreading.com/
BleepingComputer: https://www.bleepingcomputer.com/
In this episode:
[02:10] Switching from site reliability engineering (SRE) to SecOps
[03:40] How the DDoS attack on Amazon, eBay and Priceline in 2008 piqued his interest in security
[04:37] Building discipline and resilience by working on SRE teams
[09:05] Navigating Barracuda's acquisition of SKOUT
[10:22] How growing companies can benefit from a external XDR platform
[11:50] Prioritizing the alerts that matter most to customers
[13:03] Using automation to enrich threat intelligence and root out false positives
[14:50] The potential of AI-driven XDR
[16:40] How cyber attacks have evolved as adversaries use AI tools like FraudGPT and WormGPT
[19:30] Adam's three key takeaways from researching the history of cybersecurity
[23:20] Strategies for tackling the talent shortage
[25:15] Empowering teams to do their best work
[28:10] How Adam stay on top of the latest security trends
[31:35] The importance of making mistakes
[32:20] Promoting a culture of blameless incident reviews
[34:40] Predictions for the future
[35:50] Connect with Adam
If you like this episode you’ll love
Episode Comments
Generate a badge
Get a badge for your website that links back to this episode
<a href="https://goodpods.com/podcasts/the-future-of-security-operations-208042/reddits-matt-johansen-on-renouncing-superhero-culture-and-what-comes-n-48010044"> <img src="https://storage.googleapis.com/goodpods-images-bucket/badges/generic-badge-1.svg" alt="listen to reddit’s matt johansen on renouncing superhero culture and what comes next after “shift left” on goodpods" style="width: 225px" /> </a>
Copy