Leadership Profile
I build security engineering organizations from nothing and stay hands-on once they exist. Over 20 years that has meant security architecture, cryptographic key management and custody, application and supply chain security, DevSecOps, detection and response, and GRC for distributed teams in regulated, high-scale, and digital-asset environments.
Most recently I was VP of Security & Infrastructure at Chia Network, where I owned security engineering end to end: security architecture, AppSec and supply chain security for a fully public codebase, SecOps and detection, SDLC guardrails, GRC, and the AWS/GCP platform all of it ran on. I architected their HSM-based multi-signature custody and signing authorization system. Chia's threat model was unusual. We absorbed the attacker scale of a major investment bank while publishing every line of code for public review.
I worked closely with engineering on threat modeling, attack-path analysis, and security architecture reviews before anything hit production. I led secure agentic adoption across the company (~90% of employees), with data classification, access models, human-in-the-loop controls, and SDLC guardrails that helped the team ship roughly 4x faster without blowing up the blast radius. I started the bug bounty and coordinated disclosure program; automated triage marks 99.9% of thousands of daily submissions as duplicate before an analyst ever looks at them.
I treat the platform itself as part of the attack surface. At Chia that meant infrastructure-as-code with Terraform and Ansible, identity and endpoint standards, secrets management, monitoring and alerting, and a hardened build and release path. The controls shipped as default behavior rather than a review step, and critical services held 99.9999% uptime across three continents.
Those programs aligned to NIST CSF, ISO 27001, and SOC 2 Type II. I worked with legal, auditors, vendors, and law enforcement on compliance, third-party risk, and financial-crime mitigation.
Before Chia, at T-Mobile, I led platform security architecture for 35,000 internal engineers and a 30-engineer team securing GitLab-driven CI/CD, secrets management, and machine identity at enterprise scale.
I'm a Penn State alumnus (BS, Information Sciences and Technology) and former PSU OIT Red Hat systems administrator.
I like building Secure-by-Design frameworks that hold up in financial services and decentralized ecosystems. Good documentation, clear process, and zero-trust integrity around high-value assets matter to me. So does making security feel like a team sport, not a gate.
Security is a team sport!
Program at a Glance
| Domain | Program Outcomes |
|---|---|
| Security Architecture & Engineering | Threat modeling, attack-path analysis, and architecture review as mandatory pre-production gates across every internal and external repository; secure-by-design controls shipped as platform defaults rather than review steps |
| Custody & Treasury Risk | HSM-based multi-signature signing authorization; transaction policy controls and delegated approvals; $200M treasury protection; key-holder safety program across three continents |
| Signing & Key Management | Enterprise key lifecycle; secure signing workflows; secrets management; privileged access; PKI-adjacent services |
| AppSec & Supply Chain | Open-source security at investment-bank attacker scale; supply chain hardening across all internal and external repositories; architecture review before production; bug bounty with automated triage (99.9% of thousands of daily submissions marked duplicate) |
| Agentic & AI Security | ~90% employee adoption; data classification; human-in-the-loop controls; control-by-design for AI-assisted development; ~4x release velocity |
| Detection & Response | Daily SIEM triage and remediation; incident response and threat modeling; residual risk assessment; pen test coordination; blameless post-mortem culture |
| DevSecOps at Scale | T-Mobile GitLab platform serving 35,000 engineers; 100,000+ daily pipeline activities; machine/service identities and pipeline secrets; enterprise DevSecOps transformation; Chia supply chain and delivery hardening |
| DevOps & SDLC | End-to-end SDLC ownership for a massive open-source codebase; hardened CI/CD, release engineering, and DevSecOps pipelines; secure agentic adoption with ~4x release velocity and bounded blast radius |
| GRC | SOC 2 Type II certified; ISO 27001 readiness; NIST CSF alignment; automated audit cycles reducing prep from six weeks to three |
| Platform & Cloud Security | AWS and GCP platform ownership with Terraform and Ansible infrastructure-as-code; hardened baselines, network segmentation, and secrets management; monitoring, alerting, and observability at 99.9999% critical-service uptime |
| Identity & Endpoint Security | Identity, access, and endpoint security standards for a distributed workforce across 10 countries; privileged access and SSO-based access auditing; end-user security from employee #24 through 100+ |
| Global Operations | Security practice across 10 countries and 4 continents; US, EMEA, and APAC footprint; vendor and colocation selection, ITSM-aligned incident and change discipline, and executive escalation for critical services |
Current Focus
Founder at Vericreate
2026 to PresentProtect the Human Element in an Agentic Future.
Vericreate provides cryptographically-backed proof of human contribution: verifiable attestation that a piece of work was actually made by a person. I'm building it for students, educators, and academic integrity programs, as well as for artists, coders, and designers.
It's the same problem set I spent six years on at Chia: key management, signing authorization, provenance, and trust in systems where the stakes are high and the adversary is motivated. This time it's pointed at authorship instead of treasury.
Most Recent Role
Vice President of Security & Infrastructure at Chia Network
Dec 2022 to Oct 2026I was Vice President of Security & Infrastructure at Chia Network, where I owned security engineering end to end for a major open-source blockchain and technology company, along with the platform it ran on.
My scope spanned security architecture and threat modeling, cryptographic custody and signing authorization, AppSec and supply chain security, SecOps and detection, SDLC guardrails, GRC, and the AWS and GCP platform underneath it. Chia's security model is unusual: the company operates at the attacker scale of a major investment bank while publishing its entire codebase for public review.
- Architected Chia HSM-backed multi-signature custody with transaction authorization, policy controls, delegated approvals, and secure signing workflows for high-value treasury across three continents; cut spend resolution 3 days.
- Led threat modeling, attack-path analysis, and security architecture reviews as pre-prod checkpoints across public/private codebases.
- Founded bug bounty and coordinated disclosure; automated triage marks 99.9% of thousands of daily submissions duplicate before analyst review.
- Led secure agentic adoption (~90% of employees): data classification, access models, human-in-the-loop controls, SDLC guardrails; ~4x release velocity, bounded blast radius.
- Hardened CI/CD, release engineering, and DevSecOps for a massive public codebase; supply chain security at investment-bank attacker scale.
- Built real-time safety and asset protection for key holders guarding $200M treasury.
- Shortened SOC audit prep from six weeks to three; passed SOC 2 Type II recertification in Q2 2026.
- Engineered the platform as a control surface: Terraform/Ansible infrastructure-as-code, hardened baselines, network segmentation, secrets management, and monitoring that held 99.9999% uptime on critical services.
- Set identity, access, and endpoint security standards for a distributed workforce: SSO, privileged access, and end-user security from early stage through 100+ employees.
- Ran a security practice across 10 countries, 4 continents: crypto spends, key-holder safety, internal security, GRC.
- Selected and secured logistics and colocation vendors for global digital ops in the US, Europe, and Southeast Asia.
- Built and led the global security engineering function: architecture, custody, AppSec, SecOps, GRC, and platform security.
HSM Custody & Signing Authorization
The HSM-based authorization system I built at Chia protects high-value treasury and settlement operations. Here's how it works:
- Signing & authorization: Multi-signature workflows, transaction authorization, policy controls, and delegated approvals
- Key management: Enterprise key lifecycle, HSM-backed signing, secrets management, and privileged access
- Blast radius: Policy-bound controls limiting who can sign, what can move, and under what conditions
- Assurance: Threat modeling, security architecture review, and control-by-design delivery in regulated contexts
Thought Leadership & Blogs
Writing on custody, signing authorization, AI-assisted vulnerability management, and getting audit-ready.
Offensive & AI Security
Chia 2.7.1 is Out, Upgrade Now
The next step in Chia's spring security push: post-mortems for 2.6.x and 2.7.0, plus fixes found after 2.7.0 shipped.
Read on Chia BlogSecurity Patches Q&A
Community Q&A on the 2.6.x / 2.7.x security releases and what we learned from AI-assisted bounty triage at scale.
Watch on YouTubeThe AI Siege: Combatting the LLM Attacker
A technical framework for AI-enabled threats; automated triage of thousands of daily bug bounty submissions with 99.9% marked duplicate before analyst review.
Read on Chia BlogWallet, Custody & Platform Security
Part 1: Wrench-Resistant by Design
Institutional custody and multi-signature design for real-world safety, not just cryptographic elegance.
View SeriesPart 2: Account model just isn't good enough
Why traditional account-based custody models fall short for high-value assets, and what a coin-set approach enables instead.
Read MorePart 3: What does all this mean?
Delegated authority and wrench-resistant design for operators, key holders, and the ecosystem.
Read MoreSOC 2 Type II Certification and Our Commitment to Security and Auditability
How Chia achieved SOC 2 Type II certification and what it signals about the company's commitment to security, auditability, and enterprise readiness.
Read MoreVideo: Global ASIC Rollout
Technical walkthrough of the global expansion of the Timelord network and ASIC hardware security.
Watch on YouTubeCareer Highlights
Vice President of Security & Infrastructure at Chia Network
Dec 2022 to Oct 2026Executive owner of security engineering: architecture, custody, AppSec, SecOps, GRC, and the global platform it ran on, for a distributed open-source blockchain company across 10 countries.
- HSM-based multi-signature custody and signing authorization for high-value treasury operations across three continents
- Threat modeling, attack-path analysis, and architecture review established as mandatory pre-production gates across every repository
- SOC 2 Type II certification; shortened audit prep from six weeks to three
- Led secure agentic adoption (~90% of employees) with ~4x release velocity and bounded blast radius
- Bug bounty program with automated triage marking 99.9% of thousands of daily submissions duplicate before analyst review
- 99.9999% critical-service uptime across US, EMEA, and APAC colocation and cloud estates
Head of Platform and Security at Chia Network
Oct 2020 to Dec 2022Joined Chia as head of Platform and Security during rapid growth, taking operations, DevOps, platform, and security responsibilities from the CEO. Sole ops/security engineer for roughly a year before hiring and growing the team to 14 engineers through public blockchain launch.
- Architected greenfield GCP/AWS platform security: IAM, network segmentation, secrets management, and hardened CI/CD from bare accounts to production
- Built security operations and IT infrastructure from employee #24 to 100, establishing the foundation for today's global security program
- Prepared the company for pre-IPO audits: SOC 2, ISO 27001, blameless post-mortem culture (Chia Network post-mortem repo)
- Hardened supply chain and delivery pipelines; mitigated 100+ security incidents daily across a massive open-source codebase
- Implemented incident response and threat modeling; 99.9999% uptime for critical services
- Instituted end-user security and tooling standards across all internal and external repositories
Principal Architect, Continuous Delivery Platform at T-Mobile
Jun 2019 to Oct 2020Principal Architect on T-Mobile's shared Continuous Delivery Platform (GitLab SaaS), servicing 35,000 internal engineers. Led a 30-engineer team accountable for service performance, change and release discipline, developer adoption, and enterprise-wide DevOps pipeline modernization.
Designed and implemented a GitOps-driven CI/CD pipeline for T-Mobile's cloud-based platform, handling 100,000+ pull requests, merge requests, and engineer activities daily.
Secured the CI/CD pipeline and integrated security into all phases of the development lifecycle; addressed 1,500+ unique incidents daily while driving DevSecOps adoption across engineering teams.
Operationalized GitLab for enterprise-scale software delivery, reducing mean time to delivery across software projects by three weeks on average.
Governed machine/service identities and pipeline secrets; embedded security architecture into agile delivery for 35,000 engineers.
Senior DevOps Engineer at BombBomb
Jan 2018 to Jun 2019Migrated production infrastructure to Kubernetes on AWS; built microservices, improved CI/CD, and strengthened monitoring and observability for a SaaS video engagement platform.
- Operated AWS EKS with GitOps delivery, SSO-based access auditing, and SOC 2 aligned controls
- Improved local development environments, release reliability, and platform stability for customer-facing services
Senior Systems Engineer at 10up
Aug 2014 to Jan 2018Designed and operated AWS-hosted environments for enterprise publishing clients (Microsoft, ESPN, Adobe, and others): deployment, scaling, Linux platform support, and production operations.
- Built container infrastructure with Ansible and Kubernetes; automated deployment and multi-tenant access controls
- Supported regulated SaaS customer contexts including HIPAA and FedRAMP requirements
- Owned incident response, maintenance, and after-action reporting for customer-facing outages
Platform Team Lead / Platform Systems Administrator at Hosting.com
May 2011 to Jul 2013Linux and Windows systems administration for internal and customer-facing servers across a continent-wide managed hosting network.
- Operated managed cloud and hosting infrastructure supporting HIPAA and FedRAMP customer compliance requirements
- Led platform team operations as escalation POC: work delegation, kanban workflow management, and cross-team coordination
Red Hat Systems Administrator, OIT at Penn State University
May 2013 to Aug 2014Linux platform operations for Penn State World Campus web properties and classroom technology during a modernization push from hand-rolled VMs toward infrastructure-as-code and cloud-friendly delivery.
- Deployed DevOps culture and CI/CD workflow for World Campus web and classroom technology stacks
- Converted infrastructure to Puppet-based infrastructure as code; transitioned to GitOps for code and platform changes
- Red Hat Linux administration, patching, and security hardening in a higher-education production environment
Education
Pennsylvania State University
Graduated 2014Bachelor of Science, Information Sciences and Technology
Certifications: ITIL Foundation (AXELOS, 2014) ยท Puppet Fundamentals (2014)
Side Projects
A few things I build and advise on independently.
Bastion Cyber Security
2023 to PresentArchitecture review, threat modeling, penetration testing coordination, and incident remediation for medium to large businesses.
Aetherguard
2025 to PresentSoftware-based signals intelligence for remote work, crypto asset holders, and high net worth individuals.
What Colleagues Say
Colleagues from my enterprise platform security leadership at T-Mobile.
"Justin's approach to technology is rooted by his passion to always do what's right for his customers. Technology landscapes can be confusing and chaotic, but are ripe for Justin's ability to break down the concepts in simple terms and ensure there is continued progress. Justin is an asset for any team looking to build for the future."
"Justin was a huge part of an important cultural and technical shifts within T-Mobile that brought the T-Mobile 'customer first' attitude to our internal collaborations. Justin and team worked tirelessly to advocate for, overhaul, and automate stale business processes that were holding us back. As a result, we were able to move FAST to adopt and succeed with the Continuous Delivery Platform. My team has since enjoyed faster throughput, greater stability, and improved resiliency as a direct result of Justin's efforts."
"There are some people you work with where you're able to go 'oh so-and-so is taking care of that now' and you can just stop worrying about it getting done right. Justin is one of those people. Justin was a huge huge part of operationalizing GitLab for all of T-Mobile. I watched him shepherd a company that 'wasn't sure about this whole SaaS thing' into being comfortable leveraging a modern Git forge to deliver production software, and he did it in a way that kept internal developers, as the primary internal customer and sole source of value in a technology company, at the center, which was not by any means always easy to do."
"I had the privilege of working with Justin on a large job. Things were going sideways due to various factors, as things sometimes do. Justin stepped up; and through his can-do attitude, excellent architect skills, strong engineering understanding, and insightful leadership kept the situation from spiraling out of control. He utilized clear communication channels and frequent communications to keep teams informed of progress and next steps, reducing the stress of all involved. Justin has been added to the small list of people I trust. I would 110% work with Justin again given the chance."
"Justin is a top-notch Engineer that can easily become an invaluable 'Swiss Army Knife' for any team. He picks up new technologies quickly, adapts to situations with ease, and is a downright pleasure to work with. He has a 'can-do' attitude and I've witnessed him wield that attitude to conquer some massive problems. I highly recommend Justin and think he would be a great addition to any team."
Happy to talk about security engineering leadership, custody and signing architecture, AppSec and supply chain security, DevSecOps at scale, GRC, or how to secure AI-assisted development without slowing engineering down.
Get in touch