Splunk Product Security Program Buildout One-Pager

Splunk

Head of Product Security

Context

Partnered with Splunk to build and scale the product security program, strengthen secure development practices, and create the evidence, process, and organizational alignment needed to support a global software platform and enterprise customer expectations. Helped build Splunk's secure SDLC maturity by translating product-security goals into repeatable engineering practices: SAST/DAST workflows, app certification criteria, vulnerability triage, remediation prioritization, security scorecards, customer-trust evidence, and BSIMM/SAMM-style maturity framing across products and marketplace applications. Helped unblock enterprise customer trust by improving Splunk's product-security evidence, AppSec remediation posture, Veracode results, and secure SDLC maturity narrative. The work translated technical security improvements into customer-facing proof that supported a major enterprise deal and strengthened Splunk's broader product-security credibility.

Problem

Splunk's product portfolio, engineering footprint, and enterprise customer expectations required a stronger, more measurable, and more scalable product security function. Product security efforts needed to become less distributed and reactive, with clearer ownership, better risk visibility, stronger engineering adoption, and enterprise-grade evidence for customers and internal stakeholders. Splunk needed product-security maturity that could scale beyond individual security reviews. A growing product and app ecosystem required repeatable standards, review criteria, vulnerability workflows, reporting, engineering adoption, and customer-facing evidence. Without a structured secure SDLC, security work risked becoming reactive, inconsistent, and dependent on heroic manual effort. Enterprise security buyers do not accept vague claims that a product is secure. They require concrete evidence: SAST results, vulnerability posture, remediation velocity, secure SDLC maturity, penetration-testing confidence, risk ownership, and repeatable customer-trust artifacts. Splunk needed security evidence that could withstand customer scrutiny and support enterprise sales without overpromising or exposing sensitive internal details.

What I did

• - Defined product security strategy and multi-year roadmap.
• - Established secure SDLC, threat modeling, and risk management practices.
• - Built vulnerability management and PSIRT-aligned processes.
• - Implemented security testing and automation at scale.
• - Established security metrics, KPIs, dashboards, and executive reporting.
• - Drove security enablement for engineering teams.
• - Partnered across GRC, IT, Product, Engineering, Legal, and Executive Leadership.
• - Strengthened customer-facing security evidence and security answer capabilities.
• - Created security architecture review and design standards.
• - Built and scaled a high-performing product security team.
• - Translated product-security program goals into secure SDLC practices that could be applied across Splunk-built products and Splunkbase applications.
• - Used BSIMM and OWASP SAMM-style maturity thinking to frame product-security activities, gaps, and progress.
• - Integrated SAST, DAST, manual review, pattern hunting, linting, and targeted verification into repeatable security workflows.
• - Created or supported risk-based triage models separating hard blockers, high-priority remediation items, warnings, and follow-up findings.
• - Connected vulnerability management to release decision-making, engineering ownership, and customer-trust expectations.
• - Developed security scorecard patterns and reporting cadences for weekly, monthly, and quarterly stakeholders.
• - Supported certification criteria and review standards for Splunkbase and Splunk Certified app workflows.
• - Helped convert repeated security issues into standards, guidance, checks, and remediation patterns.
• - Balanced tool-driven findings with manual exploitability review to reduce false positives and focus engineering effort.
• - Connected secure SDLC evidence to enterprise deal support, customer security reviews, and product-security credibility.
• - Helped make product security operational: define the bar, measure the posture, route the work, verify fixes, and report progress.
• - Supported Splunk product-security remediation and evidence work tied to enterprise customer assurance.
• - Used Veracode results as one measurable signal within a broader AppSec and secure SDLC maturity story.
• - Helped identify, prioritize, and drive remediation of application-security issues that affected customer confidence.
• - Connected SAST findings, vulnerability triage, engineering remediation, and risk decision-making into customer-ready evidence.
• - Framed Veracode posture improvement as part of a broader security maturity program rather than a one-off scanner score.
• - Created or supported security scorecards, remediation summaries, and customer-facing assurance narratives.
• - Helped translate internal security work into defensible language for sales engineering, customer security teams, procurement, and leadership.
• - Balanced transparency with confidentiality by sharing useful evidence without exposing proprietary implementation or sensitive findings.
• - Aligned the work with secure SDLC, BSIMM, SAMM-style maturity expectations, and practical product-security program operations.
• - Connected the deal-unblocking effort back into lasting product-security process improvements rather than treating it as a one-time escalation.

Outcome

• - Transformed product security into a strategic, measurable, and trusted function.
• - Improved the security posture of Splunk's platform and engineering delivery model.
• - Enabled faster, safer delivery by integrating security into engineering workflows.
• - Improved the organization's ability to answer enterprise customer security questions.
• - Created repeatable operating patterns for product security governance, reporting, and remediation.
• - Strengthened cross-functional alignment between security, engineering, product, GRC, IT, legal, and leadership.
• - Improved Splunk's product-security operating model by making secure SDLC practices more repeatable and evidence-driven.
• - Helped establish stronger links between SAST/DAST findings, manual review, vulnerability triage, engineering remediation, and release risk.
• - Supported broader Splunkbase App Certification and Splunk Certified trust-signal work.
• - Helped product and engineering teams understand security expectations through clearer criteria, workflows, and reporting.
• - Created scorecard and maturity patterns that made security posture easier to communicate to leadership and customer-facing teams.
• - Strengthened customer-trust readiness by connecting secure SDLC maturity to enterprise security evidence.
• - Created a durable portfolio story showing security program buildout from policy and tooling through engineering adoption and customer-facing proof.
• - Contributed to a major enterprise deal-readiness and customer-trust effort through improved product-security evidence.
• - Supported achievement of a 100/100 Veracode result as part of a broader product-security posture story.
• - Helped convert AppSec remediation work into credible enterprise customer assurance.
• - Strengthened Splunk's ability to respond to customer security reviews with evidence instead of improvisation.
• - Improved the link between vulnerability management, secure SDLC maturity, engineering remediation, and revenue-facing customer trust.
• - Created a reusable portfolio narrative showing how product security can directly support enterprise growth without compromising technical integrity.
• - Established a durable pattern later reused in AI governance and customer-trust work: security programs must produce evidence that customers, executives, and engineers can all act on.

Evidence

• - 70%+ directional reduction in high and critical findings over time.
• - 100% secure SDLC adoption across participating engineering teams.
• - 3x increase in security coverage across key product areas.
• - Strengthened enterprise customer evidence and security-answer capabilities.
• - Faster security feedback loops and remediation cycles.
• - Public-safe metric language; exact internal measurement methodology and confidential operational details omitted.
• - Supported secure SDLC and product-security maturity across 16 Splunk-built products and 450+ marketplace applications in the broader program scope.
• - Contributed to an app certification and review operating model that triaged or addressed 800+ substantive Splunkbase findings.
• - Supported broader product-security evidence and tooling maturity that helped achieve a 100/100 Veracode result for a major enterprise deal.
• - Used maturity-model framing such as BSIMM and OWASP SAMM to structure secure development lifecycle improvements.
• - Public-safe metric language; exact internal scorecards, vulnerability records, customer identities, product-specific findings, and proprietary workflow artifacts are omitted.
• - Connected SAST results, vulnerability remediation, secure SDLC practices, and customer-facing security evidence.
• - Supported enterprise customer-trust and deal-readiness workflows through product-security engineering and assurance artifacts.
• - Public-safe metric language; exact customer name, deal value, private findings, remediation records, Veracode report details, and internal communications are omitted.