I am a lifelong cybersecurity professional focusing on application security and threat modeling. I've held many roles, from trusted product evaluator, senior security consultant, penetration tester, Director of Incident Response, Chief Security Advocate at Cisco, and startup CEO at Security Journey. I led Security Journey to an exit in 2022. In my next chapter, I'm CEO of Devici and General Partner at Kerr Ventures. At Kerr Ventures, I focus on startup investing/advising and consulting.I got into security by accident. After graduating from university, I attended a job fair to meet with a government contractor. I saw a guy sitting in a room off the hall, typing on a laptop and talking to nobody. I thought, “This line will be here when I return.” I struck up a conversation, and I met Arca Systems.Arca was looking for a system administrator, and I began the interview process. After some follow-on interviews, I was offered the job. I had no idea what a “security” company did, but there I was.The next few years were incredible, as I became a security engineer. I stood on the shoulders of giants in the industry, learning from folks who, at that time, had lifelong security experience in the government. They taught me the true meaning of threats and how threats manifest in different pieces of a system.My next stop was Cisco, where I led Cisco's Common Criteria and FIPS 140 certifications. After five years, I moved to focus on internal security through Cisco's Secure Development Lifecycle (CSDL). My first task was to bring threat modeling to engineering. I dove deep into threat modeling, grasping how to perform it at scale. I then led Cisco’s security belt program (Cisco Security Ninja). I held the title of Chief Security Advocate at Cisco, spreading security culture to all corners of the globe through security conferences, leading the Security Champions, and empowering engineers to shift security left in all products.After a few years, I left Cisco to start Security Journey. I built a product that teaches developers and product-adjacent people the foundational, intermediate, and advanced facets of application security. I led Security Journey to an exit in 2022, having been bootstrapped from day one.I enjoy sharing my knowledge on the conference scene, having been featured at RSA Conference, OWASP Global AppSec, ISC2 Security Congress, InfoSec World, DefCon's AppSec Village, and All Day DevOps. I host the award-winning Application Security Podcast and the Security Table Podcast. I hold the CISSP and CSSLP certifications.