Jason: My title is Engineering Director for Cloud Security, and I lead a few different areas of security for Netflix. We work on operational security for our Amazon environment, application security (helping developers build and operate more secure systems), incident response, privacy engineering, risk management, and fraud. We are also responsible for corporate information security, what you might more typically think of as traditional IT security.

Jason: It’s by no means a formal taxonomy, but I’ll discuss a few security automation solutions and how system designers can use them to improve that relationship. I will discuss automations that the security teams can build for developers to use. One of the examples I’ll use is a system we open sourced last year to do SSL certificate management (which has been typically problematic to work with). That’s one class of automation, a developer self-service tool.

The third class of automation is examples on internally built automation tools for security teams that helped them become more efficient and also build better relationships with developers. You are not just finding bugs and handing developers these really long and confusing PDF reports about some vulnerability that they need to fix. These tools make that a lot more efficient and effective.

Jason: There’s going to be a little bit for each of those audiences. The folks that might get the most out of it would not be security teams, but general software engineers who may be working on security systems. Security engineers who are trying to figure out how to work with developers more effectively in an agile environment.  The talk will also try to help general software engineers who have had bad experiences with security teams in the past understand why those experiences went wrong, and how the mind of a security person works. Hopefully, the talk will help  bridge the gap between the different teams.