Nico Waisman’s path to becoming a leader in AI-driven offensive security is a compelling narrative of self-discovery and adaptability. Born in Argentina in the early 1980s, Waisman grew up in a post-dictatorship era, a time marked by youthful defiance. His interest in technology led him to hacking, driven by curiosity rather than malice or financial gain, and a self-taught approach that laid the groundwork for his future.
The Early Days: Embracing Technology
In a country where formal education in cybersecurity was non-existent, Waisman taught himself about coding and vulnerabilities through trial and error. The lack of available documentation made this journey both challenging and fascinating. He relished the process of reverse engineering and experimenting with technology, which became the cornerstone of his career in offensive security.
Despite exploring formal education paths in engineering and journalism, Waisman never completed these courses, as his passion for hacking remained. In 2003, he joined Immunity as a senior security researcher, leveraging his self-taught skills to kickstart his professional journey. Over a 17-year tenure, he advanced to VP of Latin America, contributing significantly to the development of penetration testing frameworks.
Professional Growth and Leadership
While at Immunity, Waisman honed his communication and leadership skills, eventually leading teams and projects. Speaking at conferences and collaborating on security initiatives, he embraced the notion that leadership involves a natural evolution rather than a planned trajectory. His career further evolved when he joined Semmle, later acquired by GitHub, where he focused on enhancing open source security.
At GitHub, Waisman contributed to initiatives that aimed to secure the software supply chain, collaborating with major tech companies. His efforts culminated in the establishment of the Open Source Security Foundation under the Linux Foundation. This period marked a significant expansion of his expertise in open source security.
Transition to CISO and AI Innovation
In 2020, Waisman transitioned to the defensive side of security at Lyft, becoming its Chief Information Security Officer (CISO). Here, he faced the challenge of balancing security with the fast-paced demands of a tech-driven company. His approach emphasized integrating security without hindering innovation, a strategy he likened to a well-coordinated sports team.
Waisman’s journey came full circle when he co-founded XBOW, a company combining AI with offensive security. As CISO, he spearheaded the development of AI products that simulate human-like penetration testing at scale. His career reflects a seamless integration of offensive and defensive security expertise.
Reflections and Future Challenges
Despite the absence of a structured career plan, Waisman’s journey underscores the importance of adaptability and continuous learning. He acknowledges the stress and potential burnout in cybersecurity roles, advocating for leadership that protects team members from excessive pressure.
Looking ahead, Waisman is concerned about the implications of AI in cybersecurity, cautioning that attackers might soon exploit AI-driven malware on a large scale. As the field evolves, he anticipates a period of adjustment and chaos but remains optimistic about achieving a balance between attackers and defenders.
