Turned application security into something engineering teams plan around instead of work around. Established a risk register so engineering and business leaders could explicitly accept, mitigate, or prioritize security risk, and drafted a RACI so risk management was shared across security. Rebuilt the application inventory from 36 to 230 apps, then automated end-of-life detection, defined ownership across Product & Technology, and added a rapid risk assessment so new apps could be onboarded on request. Designed and ran a tabletop exercise that clarified triage, when to bring in Incident Command, and where our process had gaps. Built a team that runs well with or without me in the room: shipped a service catalog defining how other teams work with AppSec, and ran a 45-day backfill hire from 1,800 candidates with a pipeline more diverse than the country.

“Security doesn’t inflate severities. When [a finding] is rated high, it’s actually high, so my engineers act on it with real urgency.”

2025-2026