Security Engineering Leader
Mohit Bansal.
I build and scale security engineering teams that turn reactive, manual programs into automated, telemetry-driven organizations.
01 / About
I'm a security engineering leader with 10+ years building and scaling high-impact teams across cloud infrastructure, detection & response, and application security.
My focus is turning manual, reactive security programs into automated, telemetry-driven ones. I've done this at Walmart, Okta, and now Webflow, where I lead Security Engineering across software supply-chain defense, cloud and container vulnerability management, and the endpoint and detection stack. I care about security that fits how engineers actually build: secure-by-design, metrics-driven, and automated so the safe path is the easy one.
- 10+ Years in security
- 3 Companies scaled
- 25+ Published talks & papers
What I focus on
- Cloud Security
- Detection & Response
- Application Security
- Vulnerability Management
- Threat Modeling
- Security Org Building
Recognition
- IEEE Senior Member
- Advisor
- AIUC-1 Consortium Member
02 / Experience
-
Webflow Senior Manager, Security Engineering
Lead Security Engineering: software supply-chain defense, cloud and container vulnerability management, and the endpoint and detection stack (EDR, MDM, SIEM).
-
Okta Engineering Manager, Application Security
Scaled automated security scanning across the engineering org and made threat modeling routine, without slowing release velocity.
-
Walmart Sr. Software Engineer, Security
Built automated vulnerability assignment and exposure tooling that turned a flat findings list into routed, owned, SLA-tracked work.
03 / Writing & Research
Published articles, press features, talks, and peer review across the security community.
Thought Leadership & Articles
- Sep 2026 Why MCP Security Is About Permissions Overhaul Webflow Blog
- Aug 2026 The Identity Crisis No One Planned For: Governing Nonhuman Agents at Enterprise Scale O'Reilly Radar
- Aug 2026 AI Agents Are Your Newest Product Feature. Is Your Security Thinking Keeping Up? Mind the Product
- Aug 2026 Shadow Agents, Standing Privileges, and the Governance Gap Between Deployment and Discovery O'Reilly Radar
- Aug 2026 Alert Fatigue Was the Old Problem. Decision Latency Is the New One SecureWorld
- Jul 2026 We Spent 15 Years Securing the Supply Chain. AI Agents Just Reset the Clock to Zero SecureWorld
- Jun 2026 The AI Vulnerability Surge: Transforming Vulnerability Management The Purple Book Community
- Jun 2026 Audit trails are a feature, not a compliance tax Webflow Blog
- May 2026 The GitHub Breach Wasn't a Fluke, It Was a Preview of What's Coming for All of Us The Purple Book Community
- May 2026 Trusted by Default: The npm Attack Pattern Security Teams Miss SC Media
Featured & Interviews
- Jul 2026 Navigating Telemetry-Driven Security With Mohit Bansal An interview on building telemetry-driven security programs and moving detection and response from reactive to signal-first. HackerNoon
- Jun 2026 When AI Agents Go 'God Mode,' the Security Perimeter Must Move to the Database As AI agents widen database access across the org, enforcement has to move to the data layer itself, not just good faith. The Read Replica
- May 2026 AI Can Speed Up the SOC, But Humans Own the Hard Calls AI is strong on triage, enrichment, and correlation, but humans must own irreversible actions like shutting down services or rotating credentials. The Security Digest
Talks
- Sep 2026 When the Package Is the Weapon: Detecting and Responding to npm Supply Chain Intrusions Blue Team Con 2026, Chicago
- Sep 2026 Securing the Agentic Pipeline: What Cloud Teams Get Wrong About AI Workload Trust Boundaries CloudX / API World 2026, Santa Clara
- Aug 2026 Securing AI Agents by Design ISC2, Silicon Valley
- Aug 2026 89 Seconds to Compromise: Inside npm Supply Chain Attacks and How to Fight Back BSides Las Vegas 2026
- Jul 2026 The Slowest Agent in the Room: Redesigning Defense for a World That Moves at Machine Speed Tejas Cyber Network (virtual)
- Jun 2026 More Package, More Problem: NPM Supply Chain Talk OWASP, Bay Area
Research
- Jul 2026 Securing AI Agents in the Enterprise: A Practitioner's Guide A practitioner's guide to deploying AI agents securely in the enterprise, covering agent permissions, governance frameworks, and operational trade-offs. The Purple Book Community
- Dec 2024 Permission Creep in Practice: A Longitudinal Study of Kubernetes RBAC Drift in Production Clusters A longitudinal study of how Kubernetes RBAC permissions drift from their least-privilege design in production clusters, with a model for drift velocity and the controls that curb it. IJCNIS, Vol. 16 No. 5
- Mar 2024 Policy-Driven SBOM Verification at Build Time: Enforcing Supply Chain Attestation Standards Without Disrupting Software Delivery Cadence Integrates policy-driven SBOM verification into CI/CD pipelines through incremental, risk-tiered enforcement, preserving delivery throughput while proving supply-chain attestation. Computer Fraud and Security, Vol. 2024 No. 3
- May 2023 Rethinking Remediation SLAs: Measuring Exploit Exposure Reduction Under Severity-Based and Risk-Based Vulnerability Prioritization Models Compares severity-based and risk-based prioritization models, showing risk-based approaches deliver greater exploit exposure reduction per unit of remediation effort. IJISAE, Vol. 11 No. 6s
Peer Review
- Jun 2026 Peer Reviewer International Journal of Systems Assurance Engineering and Management (IJSA), Springer
- Jun 2026 Peer Reviewer Journal of Computers, Mechanical and Management (Q1 journal)