Julien Vehent

Lead Google's threat detection organization, the Detection half of Detection & Response. I'm accountable for finding attackers across Google's infrastructure, and for the strategy, people and platforms that make that possible.

• Own detection strategy end to end: threat modeling, detection engineering, validation and 24/7 operations.
• Lead a multi-team organization of managers and engineers across three continents.
• Drive the shift to AI-assisted detection and investigation, from probabilistic detection across the kill chain to model-assisted analyst workflows.
• Partner with security, Cloud and infrastructure leadership on priorities, funding and risk reporting.

Built and led the team that protects Google Cloud from threats across millions of projects and hundreds of thousands of customers, against attackers ranging from opportunists to state actors.

• Created and executed Google Cloud's multi-year threat detection strategy, aligned with Cloud's goal of being the most secure cloud, and partnered with VPs and GMs on its funding and reporting.
• Scaled detection engineering to planet-wide pipelines running thousands of rules across exabytes of logs.
• Grew the team 5× in three years, hiring across North America and Australia and developing the managers and senior engineers who led the expansion. Managed ~30 people across three continents.
• Ran efficient 24/7, follow-the-sun security investigations.

Featured on the Cloud Security Podcast by Google: Modern Threat Detection at Google (2021).

Built and led the security team for Firefox's cloud infrastructure. Reported to the board on Mozilla's security posture, owned product and services security, and set the security roadmap for Firefox's cloud services and release engineering.

• Built a remote DevSecOps team of ~12 from the ground up across North America and Europe, covering security operations, application security, red team and metrics.
• Owned security for 100+ cloud services serving 300M+ Firefox users across AWS, GCP and datacenters.
• Executed a multi-year strategy to mature security operations, reduce incidents and ship products secure by default.
• Created a metrics program that measured maturity and impact and reported security KPIs to leadership.
• Made security part of how ~300 people across dozens of product teams build software, from design review through testing, audits and end-of-life.
• Led incident response for Firefox infrastructure, co-owned the bug bounty program, and sat on Mozilla's security council.
• Built the services behind it: Firefox's code-signing backend (Autograph), secrets management (SOPS), TLS auditing (TLS Observatory) and fraud detection. This work became the book Securing DevOps.

• Created MIG (Mozilla InvestiGator) and ran it across thousands of servers, letting investigators query 1,000 endpoints in about ten seconds.
• Co-designed Mozilla's Rapid Risk Assessment framework, adopted across the organization to evaluate product and service risk.
• Wrote Mozilla's Server Side TLS guidelines, a reference used well beyond Mozilla.
• Led application security reviews for web services and APIs, and helped operations teams design secure platforms on AWS.