CISO Series Podcast Secure by Design. Ignored by Default.
Aug 18, 2026
Julie Davila, president of Security Tinkerers and seasoned security leader who builds software factory security frameworks. She explores treating security as a quality discipline. They discuss architecture-driven incidents and why blanket best practices fail. Practical stories cover serverless, automation, compliance realities, ownership tradeoffs, and constraining agents to limit blast radius.
AI Snips
Chapters
Transcript
Episode notes
Make Security A Development Quality
- Making insecure code impossible to ship is appealing but unrealistic today; security must be embedded in development responsibilities.
- Andy: shift ownership to heads of engineering and treat security as a basic quality discipline inside SDLC.
Contain Blast Radius Over Chasing Perfect Code
- Secure code alone rarely causes major incidents; system interactions and blast radius matter more.
- Julie: focus on containment and infrastructure guardrails so flawed code can't produce catastrophic outcomes.
Serverless Design Beat Dogmatic FedRAMP Scans
- Julie's startup used serverless Lambdas and AWS backplane so DB access never traversed public network.
- FedRAMP auditors insisted on scanning a DB by spinning raw compute, conflicting with a more secure architecture.