Name: NDC Security 2025
Start: 2025-01-20
End: 2025-01-23
Location: NDC Security

Aldan is a Fulbright Student, sponsored by the U.S. Department of State. He studied Computer Science in Spain, France, and Switzerland, graduating as valedictorian. He has completed four internships and been a Google Summer of Code contributor for Django. He received a public grant to undertake research on Natural Language Processing, and has been recognized for leadership and academic excellence through several awards. He is also the founder of 3 associations and contributes to open source. Currently, he is employed as a Technology Research Specialist working on Knowledge Graphs and Natural Language Processing in Accenture Labs.

Anders is a software engineer with a passion for message driven systems and robust distributed systems, as well as DDD and sociotechnical concepts. He works building simple and secure software, while also being part of the management group at Omegapoint Norge.

Anders Abel is an senior .NET developer in Stockholm. He has been programming since he was 9 and still thinks it’s tremendously fun. He works with Duende Software on IdentityServer and designing identity and security solutions.

Andrea works as an Advisor on Application Security at Equinor ASA. Passionate about computer, he has always been deep into software development, holding a both technical and leadership roles over the past 15 years. His current focus is security for ML/AI systems, from their inception to their deployment and operations.

Avishay Zawoznik manages the content group in Cato’s security research department, carrying ten years of experience in different fields of network and web security. Avishay specializes in network-based and application-based attack research, keeping up with the latest security publications, analyzing and implementing ways to detect and mitigate potential threats, focusing on a data-oriented approach provided by Cato’s cloud network, and looking at variants of exploits seen in the wild.

He has held cyber security, data scientist, and leadership roles at JP Morgan Chase, the Federal Reserve Bank of New York, Bloomberg, and Goldman Sachs. Brennan holds a masters' degree in Business Analytics from New York University and participates in the data science community with his non-profit pro-bono work at DataKind. 

Christian August Holm Hansen is the co-founder of Binary Security, a consulting agency focusing on penetration testing, application- and cloud security. He has worked in offensive security since 2015 and done cloud security research and bug bounty on Google Cloud Platform since 2017. In recent years, he has focused more on Azure cloud research, as that is more prevalent in Norway.

Dave is a veteran of the security industry, working across a range of industries and performing a range of security functions.  An engineer and developer at heart, his focus has been more toward all aspects of application security, from finding vulnerabilities to designing and architecting solutions

Senior Threat Analyst at TRUESEC.
Microsoft MVP in Security.
Background in security, networking, development, PCI DSS.

Podcast Host, Synthesiser Nerd and Musician.

I'm annoying nation-state antagonists on a daily basis.

Eivind is a developer and Head of Cybersecurity at Omegapoint Norge. He has extensive experience as a full stack developer, and with application security. He is committed to building resilient and secure systems through good craftsmanship. Eivind constantly searches for best practices, believing that the simplest solution is often the best.

Emil Vaagland is the IT Security Manager in FINN.no/Schibsted Marketplaces where he is trying to scale effective appsec across hundreds of developers and teams. Previously he has experience from being a part of both engineering teams developing products to doing hands-on security engineering work to scale appsec. 

Gary Lopez is a Senior Red Teamer on Microsoft's AI Red Team. In his current role, he collaborates with a diverse group of interdisciplinary experts, all dedicated to adopting an attacker's mindset to critically probe and test AI systems. Gary Lopez is the creator of Microsoft’s PyRIT (Python Risk Identification Toolkit), the team’s main red teaming automation tool. Prior to his tenure at Microsoft, Gary worked at Booz Allen Hamilton focusing on cybersecurity, developing tools for reverse engineering and malware analysis, specially targeting, and mitigating vulnerabilities within critical infrastructure including SCADA, ICS and DCS systems. He is also a graduate student at Georgetown University in the Applied Intelligence program focusing on Cyber Intelligence. 

Halvor Sakshaug is involved in everything AppSec at PG Forsta. His main interests are Content Security Policy (and everything else that can protect the client), bug bounties, teaching security, and looking for vulnerabilities.

In his spare time he does real debugging by helping people get rid of silverfish.

Håvard graduated from NTNU with a degree in computer science  in 2020 and is currently working at Capra Consulting in Oslo as a software developer. 

In his spare time he likes to read and talk history to anyone who will listen to him. This inspired him to create a podcast with two good friends and colleagues about the history of computers through the lense of historical bugs, failed projects and the times software failed its creators. 

Ignat is a systems engineer at Cloudflare working mostly on Linux, platforms and hardware security. Ignat’s interests are cryptography, hacking, and low-level programming. Before Cloudflare, Ignat worked as a senior security engineer for Samsung Electronics’ Mobile Communications Division. His solutions may be found in many older Samsung smart phones and tablets. Ignat started his career as a security researcher in the Ukrainian government’s communications services.

Javan is a Senior Application Security Specialist at Sage, helping software teams enhance security throughout the software development lifecycle. On the side, he lectures Secure Coding at DHBW University in Germany. Javan’s passion for ethical hacking started young, automating online games and finding security bugs, which he would report to game operators. He turned this passion into a career, first as a security consultant and later specializing in penetration testing. Javan holds a Master’s degree in IT Security Management and several certifications, including GXPN, CISSP, CCSP, and CSSLP. He has shared his research at conferences, including OWASP Global AppSec, SecTor, and HITB.

A lifelong technologist, having started coding at the age of six, Jeff has been in the industry for over 25 years. He has a love for CyberSecurity and AI, especially the human elements of both subjects. Working for a consultancy, he's seen the world change to be product- and service-oriented, and bangs the drum for ensuring that everybody is involved in delivering secure and usable offerings. Outside of work, he is co-host of the Compromising Positions podcast, a unique view of cybersecurity from outsiders' perspectives.

Publications include:
* Wired
* Forbes
* Raconteur
* IT Pro
* Business Cloud
* Information Age

Jim Manico is the founder of Manicode Security where he trains software developers on secure coding and security engineering. He is also an investor/advisor for KSOC, Nucleus Security, Signal Sciences, and BitDiscovery. Jim is a frequent speaker on secure software practices, is a Java Champion, and is the author of 'Iron-Clad Java - Building Secure Web Applications' from Oracle Press. Jim also volunteers for OWASP as the project co-lead for the OWASP ASVS and the OWASP Proactive Controls.

Johannes Bechberger is a JVM developer working on profilers and their underlying technology in the SapMachine team at SAP. This includes improvements to async-profiler and its ecosystem, a website to view the different JFR event types, and improvements to the FirefoxProfiler, making it usable in the Java world. He started at SAP in 2022 after two years of research studies at the KIT in Java security analyses. His work today comprises many open-source contributions and his blog, where he regularly writes on in-depth profiling and debugging topics. He also works on hello-ebpf, the first eBPF library for Java.

Since 2023, he's been touring Europe's Java User Groups and conferences, like JavaZone and Devoxx Belgium, to speak on various topics.

Joona is a seasoned hacker with over two decades of experience in the fields of software development and information security. He is recognized for his significant contributions to the open-source community, notably his work on acme-dns, ffuf, and certbot.

During days he works to secure hundreds of applications as the Head of Security Testing at Visma

Dr. Kim Wuyts is a leading privacy engineering expert with over 15 years of experience in security and privacy. Before joining PwC Belgium as Manager Cyber & Privacy, Kim was a senior researcher at KU Leuven where she led the development and extension of LINDDUN, a popular privacy threat modeling framework. 

Her mission is to raise privacy awareness and get organizations to embrace privacy engineering best practices. She is a guest lecturer, experienced speaker, and invited keynote at international privacy and security conferences such as OWASP Global AppSec, BruCon, RSA, Troopers, CPDP, APF and IAPP DPC. In the last few years, Kim has been delivering privacy awareness and privacy threat modeling training at many events, including academic guest lectures and corporate training.

Kim is also a co-author of the Threat Modeling Manifesto+Capabilities, program co-chair of the International Workshop on Privacy Engineering (IWPE), and a member of ENISA’s working group on Data Protection Engineering.

Dr. Kyle Kotowick is the founder of a Canadian consulting and development firm focusing on cloud infrastructure, security, and Internet-of-Things implementations for high-growth clients. He completed his Ph.D. in MIT's Computer Science and Artificial Intelligence Laboratory, joint with the Department of Aeronautics and Astronautics. He has served as a consultant, systems architect, and developer for global firms, startups, and universities; as a project lead for military medical and communication technology; and as a researcher for military navigation systems and for life support systems in space. He specializes in working with both startups and enterprise clients to define requirements and explore possible solutions, as well as in leading the development of project architecture, cloud services, and back-end software.

Laura Bell Main is recognized as a global leader in developing secure software. As the CEO of SafeStack, a leading secure development education platform, she helps software development leaders worldwide engage their entire team in cyber security. She is the co-author of "Agile Application Security" (O’Reilly Media) and "Security for Everyone" (Holloway). 

Her work has been featured in many international publications, including WIRED and MIT Tech Review. She has presented at BlackHat USA, and RenderATL, as well as leading international software development and cyber security conferences.

When you follow the cables, behind every piece of tech is a person, consumer and creator, and we should never lose sight of this.

Lianne is an award-winning cyber anthropologist and security transformation leader with experience in the retail, healthcare, finance, private and non-profit sectors. 

Her consultancy, The AnthroSecurist, enables teams in complex organisations to understand each other’s motivations, identify barriers that have prevented good security practices in the past, and provide practical steps and insights to increase collaboration between the security team and the rest of the organisation. Lianne is also the Head of SecOps for the largest greenfield technology project in Europe where she builds strategies to create sustainable security cultures throughout the organisation. 

As a respected keynote speaker, Lianne has delivered talks across the globe to share her vision for a new type of security function. Drawing upon her expertise as an anthropologist, her practical experience as a security-focused software developer and as a security practitioner; Lianne combines the human and the technical aspects of security to evangelise a cultural security transformation.

In 2020 Lianne formed a health-tech start-up, Liria Digital Health, using technology to improve patient outcomes for those with under-researched, under-represented or unloved health conditions, particularly for people in marganised or minority communities

You can listen to Lianne talk about her human-centric approach every Thursday on her award-winning technology podcast Compromising Positions, in which she interviews non-cybersecurity people from the world of anthropology, psychology and behavioural science about cybersecurity culture.

Lianne is also undertaking a MSc in AI and Data in 2024. 

Publications include:

* The Times
* Raconteur 
* Computing.com
* The Yorkshire Post
* Security Magazine
* IT Pro 
* EmTech Anthropology Careers at the Frontier (Book)

Recent awards and honours include:

* Podcast Newcomer - 2024 European Cybersecurity Blogger Awards
* Cybersecurity Personality of the Year 2023 - The Real Cyber Awards
* Security Woman of the Year - Computing Security Excellence Awards 2023 (Highly Commended)
* 40 Under 40 in Cybersecurity - Cybersecurity Magazine
* Security Leader of The Year 2021 - Women in Tech Excellence 
* Woman of the Year 2021 - Women in Tech Excellence
* Security Specialist of the Year 2021 - Computing.com


Mathew Caplan is Managing Consultant for Orange Cyberdefense based in London, England. He is a highly experienced information security and compliance specialist with over 25 years in the field and a proven record in the implementation of information risk management solutions, frameworks and processes.

As a recognised trusted advisor, Mathew has advised many businesses on cybersecurity strategy and governance. Mathew enjoys finding sustainable solutions to challenging problems. He works in the Orange Group on many international projects being the go-to guy on security and compliance matters for some very high-profile customers.

Mathew loves cats, music, and football and wherever possible will combine his audio-visual and photoshop skills to simplify complex topics and breathe life into cybersecurity.

Matteo Malvica is a senior content developer and security researcher at OffSec focusing on vulnerability research, exploit development, reverse engineering and operating system internals.

Michael Kerrisk is a trainer, author, and programmer who has a passion for investigating and explaining software systems. He is the author of "The Linux Programming Interface", a widely acclaimed book on Linux (and UNIX) system programming. He has been actively involved in the Linux development community since 2000, operating mainly in the area of testing, design review, and documentation of kernel-user-space interfaces. Since 2004, he has maintained the Linux "man-pages" project, which provides the primary documentation for Linux system calls and C library functions. Michael is a New Zealander, living in Munich, Germany, from where he operates a training business (man7.org) providing low-level Linux programming courses in Europe, North America, and occasionally further afield.

Neil Madden is the founder and CEO of Illuminated Security and the author of API Security in Action. Neil was previously the Security Architect for ForgeRock, and is an active contributor to the OAuth and JOSE Working Groups at the IETF. In 2021, Neil discovered a critical vulnerability in Java's elliptic curve digital signature algorithm (ECDSA), which was dubbed the "cryptography bug of the year" and named as one of the top 10 web hacking techniques of 2022. Neil has a PhD in Computer Science and lives in the Cotswolds, England with his wife and daughter

Niall is an Irish guy who managed to end up in Norway after finding out the country existed when he was in New Zealand. He works at Microsoft helping customers with their technology investments. He has very strong opinions on security, web tech, food and wine. 

Niels Tanis has got a background in .NET development, pentesting and security consultancy. He is Microsoft MVP and has been involved in breaking, defending and building secure applications. He joined Veracode in 2015 and right now he works as a security researcher on a variant of languages and technologies related to Veracode’s Binary Static Analysis service. He is married, father of two and lives in a small village just outside Amersfoort, The Netherlands.

Patricia Aas is an international speaker and has spoken at CppCon, ACCU, C++OnSea, NDC Security, NDC Oslo and many other conferences on subjects ranging from Sandboxing in Chromium to Vulnerabilities in C++. She has taught a range of subjects in Computer Science at the University of Oslo.

Patricia has a masters degree in Computer Science and 13 years professional experience as a programmer, most of that time programming in C++. During that time she has worked in codebases with a high focus on security: two browsers (Opera and Vivaldi) and embedded Cisco telepresence systems.

Philippe De Ryck specializes in making web security accessible to developers and architects, leveraging his Ph.D. from KU Leuven to inform his comprehensive understanding of security challenges. As the founder of Pragmatic Web Security, he provides practical security training and consulting services to organizations worldwide. 

His online course platform offers a self-paced approach to learning about security. Philippe also actively helps shape OAuth 2.0 best practices as the co-author of the best practices for browser-based apps specification. 

Philippe is recognized as a Google Developer Expert, acknowledging his contributions to web application and API security. He also organizes SecAppDev, an annual week-long application security course in Belgium.

With over 13 years of experience in the computer software industry, I am a seasoned Software Engineer adept at crafting Cloud Native applications and Web applications, primarily utilising Golang, .Net, and React (TypeScript). Throughout my professional journey, I have honed my skills in diverse programming languages such as C#, Golang, and JavaScript. My expertise extends to leveraging various tools and technologies, and I have gained exposure to multiple cloud solutions, including AWS, GCP, and DO.

I thrive on challenges and actively seek projects that push me beyond my comfort zone, allowing me to expand my knowledge and skill set. The continuous pursuit of learning new languages and development techniques is not only a personal passion but also a commitment to contributing to the success of the organisations I work with.


Ramona is a developer advocate and software engineer with roots in quality assurance. She owns both views of the product - that of a tester and a developer. Ramona primarily uses this to strengthen trust in test automation and support the testers and developers alike, becoming a Google Developer Expert in Web Technologies, Women Techmaker Ambassador, and Cypress ambassador. 

Roberto Rodriquez is a Principal Security AI Researcher at Microsoft, where he focuses on exploring and developing solutions that leverage autonomous agents to defend and protect the organization. He is the founder of the Open Threat Research (OTR) community, which fosters collaboration and shares innovative research projects with the broader security community. Roberto is also the author of several influential open-source projects, including the Threat Hunter Playbook, Security Datasets, OSSEM, SimuLand, and ATT&CK Python Client. To follow his latest work and contributions, visit https://blog.openthreatresearch.com/ and https://github.com/OTRF

Scott Helme is a security researcher, consultant and international speaker. He can often be found talking about web security and performance online and helping organisations better deploy both.

Founder of report-uri.com, a free CSP report collection service, and securityheaders.com, a free security analyser, Scott has a tendency to always be involved in building something new and exciting.

Sebastien Deleersnyder, CTO and co-founder of Toreon, has a deep cybersecurity background. He has trained many developers in secure coding practices, founded the Belgian OWASP chapter, and contributed significantly to OWASP projects like SAMM. Now, he’s focusing on integrating application security into DevOps and expanding the reach of threat modeling.

I've been working as a .NET developer for over 16 years now in a variety of industries including government, retail and manufacturing. But I've been hacking around with computer code since I was old enough to read my Dad's copy of the ZX Spectrum BASIC coders manual. 

I've been speaking about Functional C# at various user groups and conferences around the UK, USA,  Europe and Australia and am particularly interested in seeing just how far we can push C# without breaking it.  

In 2023 I released my first technical book: "Functional Programming with C#", published by O'Reilly Media.  

When I'm not coding, or running after my two small children, I have been known to enjoy the classic series of Doctor Who, Fighting Fantasy Gamebooks, Cryptic Crosswords, and rather more coffee than is probably good for me.

Sofia works as a security specialist at Binary Security. She started her career with a PhD in pure maths, followed by three years at Cisco developing one of their networking OSs. She eventually made her way into security testing, which she has been doing for two years. 

STÖK operates at the crossroads of cybersecurity & creativity. With Swedish roots, STÖK has carved out a distinctive niche as a creative, hacker, keynote speaker and cybersecurity professional. His curiosity and dedication to sharing what he learned shines through his robust online community. His creative presentation style and hacker insights have graced the main stages of globally recognized cybersecurity events such as Black Hat USA, DEF CON, Securityfest, SEC-T, Disobey, and EKO PARTY, further establishing his influence in the community.

Diving into cybersecurity in the early '90s, STÖK has pioneered a holistic approach, harmonizing defensive strategies with an aggressive hacker's mindset. However, his expertise extends beyond the digital frontier, incorporating a keen understanding of human psychology, marketing, fashion, and effective communication, reflecting his multifaceted interests and talents.
STÖK embodies a lifestyle where technology meets creativity, adopting a positive, forward-thinking stance on security and life. His ethos, captured in the empowering slogans "HACKERS GONNA HACK. CREATORS GONNA CREATE. GOOD VIBES ONLY," strikes a chord with his audience, injecting a vibrant, optimistic outlook into the complex cybersecurity landscape.

Tanya Janca, aka SheHacksPurple, is the best-selling author of 'Alice and Bob Learn Secure Coding', 'Alice and Bob Learn Application Security’ and the ‘AppSec Antics’ card game. 

Over her 28-year IT career she has won countless awards (including OWASP Lifetime Distinguished Member and Hacker of the Year), spoken all over the planet, and is a prolific blogger. 

Tanya has trained thousands of software developers and IT security professionals, via her online academies (We Hack Purple and Semgrep Academy), and her live training programs. Having performed counter-terrorism, led security for the 52nd Canadian general election, developed or secured countless applications, Tanya Janca is widely considered an international authority on the security of software. Tanya currently works as Staff DevRel at Semgrep.

Software engineer with years of experience in full stack development, DevOps and data engineering.
Instructed a year long full stack development course and helped students get their first roles.
Spoke in current and previous work environments around several subjects such as K8S, AWS, programming paradigms, programming languages and in conferences such as NDC Oslo, Data Saturday Edinburgh and WeAreDevelopers Berlin.
Eager to teach and learn from other professionals around the world.

Tjerand is a Security and Cryptography Expert at the cybersecurity company Pone Biometrics and an Associate Professor at the Department of Information Security and Communication Technology at NTNU. His main interests are quantum-safe cryptography, privacy-preserving computation, anonymous communication, and secure implementation. In 2020, the Norwegian Data Protection Agency awarded Tjerand and his team the "Built-in privacy" award for designing a private contact-tracing protocol used by more than 1 million Norwegians.

Tobias Ahnoff is an experienced .NET developer and architect with focus on application security. He specializes in implementing authentication flows and authorization for web applications and APIs that manage sensitive data in the bank, finance, and health sectors.

Tobias performs security reviews and penetration tests as part of Omegapoint Cybersecurity Gothenburg,  a group of experts in application security. He also gives courses in application security and is an appreciated speaker in OAuth2 and OpenID Connect areas.

Tristan has over a decade of experience in the cyber security operations space with the last 5 years being dedicated to detection engineering and SOC operations. In 2018 Tristan co-founded Seamless Intelligence which is dedicated to providing managed SOC services to customers around Australia.
 
As head of detection engineering Tristan spends too many hours each week dissecting and analysing logs and opportunities to detect attack techniques and tools. Delving ever deeper into logs and how to detect various attack tools has led to CVE/Bug Bounties from Microsoft and Crowdstrike. 

An IT consultant with more than 20 years of industry experience, Tudor is a Certified Ethical Hacker, and a Microsoft Cloud and Datacenter Management MVP. His commitment to staying at the forefront of technology trends enables him to provide valuable guidance and support to organizations seeking to navigate the ever-changing IT landscape.

His passion for sharing knowledge and engaging with the community has made him a regular speaker at local and regional community events. His speaking engagements provide valuable insights and guidance to IT industry professionals and enthusiasts.

Dr. Vera Rimmer is a research expert at the DistriNet research group at KU Leuven, where she conducts and leads research activities in the intersection of security, privacy and AI. She completed her PhD at KU Leuven in 2022, with the main focus on applying deep learning in anonymity networks and network defense systems. Currently, Vera and her team explore data analytics in network intrusion and malware detection, and trustworthiness of data-driven AI in the wider ICT context. Vera is interested in developing comprehensive understanding, reasonable expectations and mitigation of risks of data-driven AI in the age of uncontrolled data collection and inference.

Security girl in Microsoft Norway with experience more than 13 years in security. She spends all her time working closely with developers and architects to make security built in from design level. She is a big supporter of making security as culture and shifting security to the left. Viktorija believes that empowering developers and architects in security tasks by helping with education will increase security level without increasing additional workload.

During the free time, she deep dives into Cloud security, development, identity and access management.

I'm a Security Engineer at Google, currently specializing in remediating critical software vulnerabilities and leading a global team towards addressing vulnerabilities in all of Google products. I'm also part of the team managing Google's Bughunter Vulnerability Rewards Program.

I've been a security professional since 2007, and in the past 8 years I've been mostly focusing on incident response and forensics and working with developers in how to address security vulnerabilities. I worked at Apple, Microsoft, Meta and now Google.

NDC { Security }

Speakers