MO Sadek -- Building an AppSec Program from Scratch

Mo Sadek shares his unique journey of building an Application Security program from scratch at Roblox. Mo discusses his unconventional path, including temporarily joining the infrastructure team to truly understand engineering challenges. He emphasizes that security isn't about mandating rules, but about making processes easier and more secure by default. Mo shares his insights on how to build effective cross-team security relationships and approaches for gaining leadership buy-in. Mo Sadek is a security transformation leader, passionate about staying ahead of emerging threats. He's built and fine-tuned vulnerability programs, customized solutions through hands-on coding, and driven security-first approaches in AI initiatives. Known for translating complex security metrics into actionable insights, Mo excels at uniting engineers, executives, and cross-functional teams.The Application Security Podcast is brought to you by Security Journey.About Security JourneyWe help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.→ Learn more about Security JourneyConnect with MO Sadek:→ Roblox→ I Have No Mouth and I Must ScreamMentioned in this episode:→ Roblox→ I Have No Mouth and I Must Scream→ Metasploit→ GitHub Dependabot→ Robert HurlbutFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Meet MO Sadek: Building an AppSec Program from Scratch01:33 I can see the snow in your background there from the06:02 Way back to the beginning of the story. So, so, so07:18 Very cool. So jumping into the AppSec program at Roblox, you12:41 Then, how does that, your experience working on those different disciplines14:18 What, what, quick refine the question. Were you dotted line to20:39 Security. And now you mentioned incident response. Did you security engineering21:46 Mo, when you talk about, you know, the different approaches in25:16 You talked about the importance of partnership and, you know, listening29:35 How, how do you communicate this with senior leadership31:47 There metrics36:38 You mentioned, you use the term security partnership. And we certainly38:37 There's multiple partners then in the way that you think about44:24 All right. So lightning round, we have 3 questions that we47:15 All right, I'm going to check that one out. That's good