Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. Today, my guest is Rob Picard. Rob started his career as a pentester and went on to become an early security hire at both Robinhood and Vanta, where he helped establish scalable security programs. He is now leading Observa, a security consulting firm focused on helping startups build strong security foundations. Rob frequently participates in podcasts, sharing his expertise on how startups can develop security programs, often with an AppSec focus. In this episode, Rob discusses when startups should adopt application security, the key differences between AppSec challenges at startups versus large enterprises, his hot take on integrating security into internal tool development, and the importance of security training for developers. And there’s much more! This episode is perfect for anyone looking to build a security program in a startup, whether for compliance reasons or not, or for those who want to learn more about breaking into the field. Dive right in!