Diego Zamboni

Lead Avaloq's global CISO Governance team and define and monitor the company's Information Security Management System.

• Own security policy and governance direction.

• Provide second-line oversight of first-line security functions.

• Drive compliance monitoring and control effectiveness in a regulated fintech environment.

Worked with global AWS customers and internal teams to improve security posture, define secure architecture patterns and scale security awareness.

• Led security architecture in the Stellantis Virtual Engineering Workbench program.

• Established security workstreams, metrics and reporting for business and technical stakeholders.

• Helped launch and scale Security Champions and Security Guardians initiatives.

• Supported secure collaboration mechanisms for the Volkswagen Digital Production Platform.

Led security architecture, risk and compliance activities for Swisscom cloud platforms across multiple services.

• Directed compliance and governance activities including ISO27001, ISAE3402/3000 and GDPR requirements.

• Built and led a Security Champions community across IT Clouds teams.

• Coordinated threat modeling, audits, penetration testing and vulnerability management.

Built and led the Health and State Management team for Swisscom cloud platforms.

• Managed a team of up to 16 people.

• Owned roadmap and prioritization with product managers and stakeholders.

• Defined and delivered platform-wide monitoring, logging and alerting capabilities.

• Led the Orchard project through its implementation, production release and further improvements and development.

• CFEngine Advocate, with a special focus on security.

• Managed the CFEngine language roadmap.

• Created and led the CFEngine Design Center project, which was the foundation for the current CFEngine Build service.

• Coordinated the work on CFEngine third-party integration (e.g. AWS EC2, VMware, Docker and OpenStack).

• Wrote the book Learning CFEngine 3, published by O'Reilly Media, which became the de facto introductory text to CFEngine.

Member of IBM Zurich's Global Security Analysis Laboratory, working on intrusion detection, malware containment and virtualization security research.

• Established UNAM's Computer Security Area, the University's first team dedicated to computer security, which has evolved into the Information Security Coordination (UNAM-CERT).

• Managed up to nine people working on different projects related to computer security.

• Provided security services to the whole University, including incident response, security information, auditing and teaching.

Ph.D.

M.S.

Bachelor's degree

• Chief Information Security Officer for Governance at Avaloq, defining and managing Avaloq's global ISO27001-certified Information Security Management System

• Managed security architecture at the Stellantis Virtual Engineering Workbench project. Worked with Stellantis CISO and business stakeholders to define governance, establish security best practices and drive risk analysis, threat modeling and mitigation.

• Established scalable and durable mechanisms to enable partners to work securely in the Volkswagen Digital Production Platform (DPP) program.

• Managed security architecture, risk management, data governance and compliance (ISO27001, ISAE3402/3000, etc.) for Swisscom's Cloud platforms.

• Established and led the Swisscom IT Clouds security community of practice.

• Established and led the Health and State Management team at Swisscom to design, implement and operate a framework for scalable monitoring, logging and alerting for Swisscom's Cloud platforms.

• Established and led the first computer security organization at UNAM, which has grown into the university's Information Security Coordination (UNAM-CERT).

• Managed IT security customer relationships at HP Enterprise Services, including overseeing the activities of operational and engineering teams, risk and compliance management, requirements discussion and reporting.

• Designed the Orchard monitoring framework for Swisscom's Application Cloud platform, and led the team that implemented it and brought it into production.

• Designed and implemented the Billy Goat malware capture and analysis system at IBM.

See the online publications list for publication details.

• Pioneered active worm-capture technology that became the foundation for modern honeypots and honeynets

• Designed system to simulate thousands of vulnerable hosts to attract and capture propagating worms

• Implemented automated analysis to extract signatures and update intrusion detection/prevention systems

• Publications: [18], [25]

• Investigated novel approaches to data collection for intrusion detection systems

• Implemented and evaluated internal sensors and embedded detectors as data collection mechanisms

• Analyzed trade-offs and effectiveness of different sensor placement strategies in IDS architectures

• Publications: [11], [19], [20], [27], [26], [32]

• GitHub: github.com/zzamboni

• GitLab: gitlab.com/zzamboni

Diego Zamboni

Diego Zamboni

Editors: Diego Zamboni and Christopher Kruegel

James Riordan, Diego Zamboni, Yann Duponchel

Florian Kerschbaum, Eugene H. Spafford, Diego Zamboni

Diego Zamboni — CERIAS TR 2001-42

Christoph L. Schuba, Ivan V. Krsul, Markus G. Kuhn, Eugene H. Spafford, Aurobindo Sundaram, Diego Zamboni — Awarded the 2020 IEEE Security & Privacy Test of Time Award.