Michael Burch - AI-Enabled Citizen Developers
When every employee can generate working software, who owns the risk? Michael Burch, VP of AI Enablement and Acceleration at Security Journey, explains how…
Listen to the episodeTopic
Careers in AppSec
Getting into application security and going further — origin stories, hiring, mentoring, certifications, and teaching the next generation.
41 episodes
OWASP Candidate Debate - 2025 Edition
What should OWASP become, and which leaders have a credible plan to get it there? In this special 2025 Board of Directors candidate debate, nine candidates…
Listen to the episodeMarisa Fagan - Measuring Security Culture
Security champions programs rarely fail because the idea is bad; they fail because organizations launch without management support, meaningful incentives, or a plan to prove value.
Listen to the episodeJim Routh -- The CISO Transition to the rest of life
Former CISO Jim Routh discusses his perspective on retirement and career fulfillment in cybersecurity.
Listen to the episodePhillip Wylie -- Pen Testing from Somebody who Knows about Pen Testing
Philip Wiley shares his unique journey from professional wrestling to being a renowned pen tester. We define pen testing and the role of social engineering in ethical hacking.
Listen to the episodeDerek Fisher -- Hiring in Cyber/AppSec
Derek Fisher, an expert in hardware, software, and cybersecurity with over 25 years of experience is back on the podcast.
Listen to the episodeDavid Quisenberry -- Building Security, People, and Programs
David Quisenberry shares about his journey into the security world, insights on building AppSec programs in small to mid-sized companies, and the importance of data-driven decision-making.
Listen to the episodeDevin Rudnicki -- Expanding AppSec
Devon Rudnicki, the Chief Information Security Officer at Fitch Group, shares her journey of developing an application security program from scratch and advancing to the CISO role.
Listen to the episodeDustin Lehr -- Culture Change through Champions and Gamification
Dustin Lehr, Senior Director of Platform Security/Deputy CISO at Fivetran and Chief Solutions Officer at Katilyst Security, joins Robert and Chris to discuss security champions.
Listen to the episodeMeghan Jacquot -- Assumed Breach Red Team Engagements for AppSec
AppSec specialist Megan Jacquot joins Chris and Robert for a compelling conversation about community, career paths, and productive red team exercises.
Listen to the episodeBill Sempf -- Development, Security, and Teaching the Next Generation
Robert is joined by Bill Sempf, an application security architect with over 20 years of experience in software development and security.
Listen to the episodeArshan Dabirsiaghi -- Security Startups, AI Influencing AppSec, and Pixee/Codemodder.io
Arshan Dabirsiaghi of Pixee joins Robert and Chris to discuss startups, AI in appsec, and Pixee's Codemodder. io.
Listen to the episodeDr. Jared Demott -- Cloud Security & Bug Bounty
Chris and Robert are thrilled to have an insightful conversation with Dr. Jared Demott, a seasoned expert in the field of cybersecurity.
Listen to the episodeRay Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring
What does an application security leader need to know before stepping into the CISO role?
Listen to the episodeTanya Janca -- What Secure Coding Really Means
Tanya Janca, also known as SheHacksPurple, joins the Application Security Podcast again to discuss secure coding, threat modeling, education, and other topics in the AppSec world.
Listen to the episodeHasan Yasar -- Actionable SBOM via DevSecOps
Hasan Yasar believes that everyone shares the responsibility of creating a secure environment, and this can only be achieved by working collaboratively.
Listen to the episodeOWASP Board of Directors Debate
Six candidates for the 2023 OWASP Board of Directors debate the choices that shape the foundation and its community.
Listen to the episodeKevin Johnson -- Samurai Swords and Zap's Departure
Kevin Johnson is the CEO of Secure Ideas. He began his career as a developer but turned toward security when he discovered that the interface for an intrusion detection system, Snort, was out of date.
Listen to the episodeTony Quadros -- The Life of an AppSec Vendor
Tony Quadros, the AppSec Lumberjack, shares the unique career path that led him to find his passion in Application Security.
Listen to the episodeJeevan Singh -- The Future of Application Security Engineers
Jeevan Singh, the director of product security at Twilio, discusses the future of application security engineers.
Listen to the episodeChristian Frichot -- Threat Modeling with hcltm
Christian Frichot, an AppSec hacker, security leader, and developer of hcltm. He discusses the DevOps threat modeling tool he dreamed up and built.
Listen to the episodeRobyn Lundin -- Planning & organizing a penetration test as an AppSec team
Robyn Lundin started working in tech after a coding boot camp as a developer for a small startup.
Listen to the episodeWolfgang Goerlich -- Security beyond vulnerabilities
J. Wolfgang Goerlich is an Advisory CISO for Cisco Secure. He has been responsible for IT and IT security in the healthcare and financial services verticals.
Listen to the episodeAdam Shostack -- Fast, cheap and good threat models
Adam is a leading expert on threat modeling, and a consultant, expert witness, author and game designer. He has decades of experience delivering security.
Listen to the episodeTimo Pagel -- DevSecOps Maturity Model
Timo Pagel has been in the IT industry for over fifteen years. After a system administrator and web developer career, he advises customers as a DevSecOps consultant and trainer.
Listen to the episode54 mintranscript
James Ransome and Brook Schoenfield -- trust and verify: Building in Security at Agile Speed
Why do application security programs stall even after teams buy tools and define processes? James Ransome and Brook S. E.
Listen to the episodeCharles Shirer -- The most positive person in security
Charles is a Senior Security Consultant for Red Siege. He has over 18 years of experience in IT.
Listen to the episode29 mintranscript
Vandana Verma — Support each other
Building a stronger security community means helping more kinds of people participate and succeed.
Listen to the episode28 mintranscript
Chris and Robert: A Taste of Hi-5
What happens when Chris and Robert trade a single interview topic for five current application security ideas?
Listen to the episode44 mintranscript
Marc French — The AppSec CISO
Is becoming a CISO the next technical promotion, or a fundamentally different job? Marc French joins Chris and Robert to discuss the role through the eyes of an application security leader.
Listen to the episode38 mintranscript
Season 5 Finale — A cross section of #AppSec
Season 5 covered application security from tools and threat models to mentoring, self-care, coaching, dependency risk, and program design.
Listen to the episode38 mintranscript
Ronnie Flathers — Security programs big and small
Which parts of an AppSec program should change as a company grows, and which should stay the same?
Listen to the episode29 mintranscript
Elissa Shevinsky — Static Analysis early and often
Security testing is more likely to happen when it fits the way developers already work.
Listen to the episode41 mintranscript
Caroline Wong — Self-care and self-aware for security people
A successful security career can still become unsustainable when work crowds out everything else.
Listen to the episode5 mintranscript
Tanya Janca — Mentoring Monday — 5 Minute AppSec
Security needs more experienced practitioners, but people do not become senior without guidance, advocacy, and opportunities to learn.
Listen to the episode36 mintranscript
Adam Bacchus and Jon Bottarini -- Two Sides to a Bug Bounty: The Researcher and The Program
What does a bug bounty look like from both sides of the relationship? Adam Bacchus and Jon Bottarini of HackerOne compare the responsibilities of the…
Listen to the episode35 mintranscript
Jessica Robinson and Vandana Verma-- WIA: Women in #AppSec
How can application security become a field where more women enter, contribute, and advance?
Listen to the episode37 mintranscript
Rafal Los, James Jardine, and Michael Santarcangelo -- #DtSR and What Makes a Good Security Consultant?
What separates a useful security consultant from someone who merely arrives with answers?
Listen to the episode37 mintranscript
Tracy Maleeff -- Natural Paranoia as a Career Path? A Transition to Security
Can a career in library science become a foundation for information security? Tracy Maleeff joins Chris and Robert while making that transition, bringing…
Listen to the episode38 mintranscript
Deidre Diamond -- The Soft Skills of AppSec
Technical ability can open a door in security, but communication and relationships often determine what happens next.
Listen to the episode50 mintranscript
Glenn Leifheit -- An Inner Glimpse of the Microsoft SDL
How do you keep a secure development lifecycle useful as products, teams, and delivery methods change?
Listen to the episode