Julian Cohen

WORK HISTORY

ABOUT JULIAN COHEN

As a CISO, I am dedicated to building thoughtful, effective, and efficient security programs based on adversary intelligence with teams of brilliant practitioners. Throughout my career I have developed innovative ideas and practices for making accurate, effective, and efficient security decisions and predictions in the pursuit of these goals. The main things that differentiate me from other security leaders are:(1) Technical Depth. I started off my career performing vulnerability research, designing operations, and writing exploits for USDOD contractors.(2) Adversary-Based Thinking. By understanding who our adversaries are, what their motivations are, what their constraints are, what their resourcing is, and what their playbooks look like, we can prioritize better, assess risk more accurately, build more effective controls, and operate more efficiently than if we use traditional frameworks and thinking.(3) Business Perspective. Nothing works in security or risk management unless it\'s aligned with the business. My role is to identify business and security risks, suggest technical and administrative controls and fixes, and help the business continue to operate successfully under a shared risk tolerance. I started my career contracting for the United States Department of Defense, building a deep understanding of the technical and operational challenges and constraints that offensive teams have, both enterprise and government. Using this perspective, I have designed and built effective and efficient security programs and controls to help defensive teams make powerful decisions to defend against adversaries. I have held a variety of leadership roles at finance, healthcare, and technology organizations where I have (1) built security programs that have successfully defended against a diverse and sophisticated set of adversaries,(2) led security, compliance, IT, engineering, product, and due diligence teams on both sides of successful M&A events, and (3) designed and implemented novel security controls and technologies that are currently successful products or used in ubiquitous software, keeping users, data, assets, and organizations secure. In addition to my primary responsibilities, I regularly advise technology startups on enterprise risk management, security program management, product security, physical security, corporate security, security operations, and adversary-based risk modeling. I have given presentations at industry conferences and I am heavily involved in the security community, giving back whenever I can.