Devin Rudnicki -- Expanding AppSec

Devon Rudnicki, the Chief Information Security Officer at Fitch Group, shares her journey of developing an application security program from scratch and advancing to the CISO role. She emphasizes the importance of collaboration, understanding the organization's business, and using metrics to drive positive change in the security program. Devin Rudnicki, the Chief Information Security Officer at Fitch Group, developed an application security program and advanced to the CISO role after years in security governance. She holds a BS in mathematics from DePaul University and multiple certifications, including CISSP, GSTRT, GSEC, and GCSA. Outside work, she enjoys group fitness, global travel, and mentoring in cybersecurity.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey is an enterprise-class solution with lessons that are built on learning science principles to deliver long-term measurable results.→ Learn more about Security JourneyConnect with Devin Rudnicki:→ Alice and Bob Learn Application Security→ RSA ConferenceMentioned in this episode:→ Alice and Bob Learn Application Security→ RSA Conference→ Black Hat→ Walter IsaacsonFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Meet Devin Rudnicki: Expanding AppSec03:05 Very cool. So the internship, security and governance, does that lead05:03 Is that What's that approval look like as far as, is07:28 What's the first thing that you focus on with this program10:17 You're kind of, you're learning a little bit about the personalities11:41 Yes, I think that's an important tactical thing that we can14:54 Yeah. Okay. So when we, if we break the program, then17:54 Okay. So, that's the vulnerability management side. How about developer education20:23 In the past, I would say no to that question, and21:18 That's, you know, you can minimize. But yeah, I mean, pen24:49 Tracking the work. What metrics and KPIs did you use to27:05 Yeah, and I had a similar situation in my previous time30:03 Devin, we have 3 questions that we typically ask in the32:59 The gene splicing therapy. We'll find it and put it in