Show Notes
In this episode of the TPRM Podcast — Threats, Pitfalls & Risk Myths — host Nate Lee sits down with Jason Chan, former VP of Information Security at Netflix, to explore how engineering-led security, paved roads, and guardrails—not gates—reshaped modern cloud security.
Jason spent nearly a decade building one of the most influential security programs in tech. His work on paved roads, automation, least privilege, and engineering-aligned controls helped define how today’s high-velocity organizations approach risk, resilience, and scale.
They discuss:
• What the paved road was originally intended to be — and how it’s widely misunderstood
Why guardrails outperform gates in fast-moving engineering environments
The real reason vulnerability management is stuck, and how to fix it
How AI will enable security teams to scale sub-linearly — and the new risks it introduces
Build vs. buy in 2025 and where security teams should invest
Why vendor questionnaires rarely predict actual risk
Identity as the new perimeter — including non-human identities and agents
What resilience really means when third-party failures are inevitable
This episode delivers high-signal insight for CISOs, security leaders, founders, AppSec engineers, and anyone designing or evaluating modern security programs built for speed, trust, and scale.
Listen and Subscribe
Spotify → https://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA
Apple Podcasts → https://podcasts.apple.com/us/podcast/the-tprm-podcast-threats-pitfalls-and-risk-myths/id1848217699
YouTube → @TPRMPodcast
About the Host
Nate Lee is a B2B Scaleup CISO and Founder of Cloudsec.ai, helping SaaS companies build business-aligned security programs that increase developer velocity and strengthen trust.
About the Show
The TPRM Podcast explores real-world conversations with security leaders reshaping how we think about risk — uncovering the threats, pitfalls, and myths behind today’s cybersecurity challenges.
Connect with Us
Nate’s LinkedIn → https://www.linkedin.com/in/natetrustmind/
TPRM Podcast LinkedIn → https://www.linkedin.com/company/tprm-podcast/
Website → tprmpodcast.com
Instagram → @TPRMPodcast
TikTok → @tprmpodcast
Tags:
Cybersecurity, CISO, CloudSecurity, EngineeringSecurity, PavedRoad, GuardrailsNotGates, NetflixSecurity, AIinSecurity, IdentitySecurity, SublinearScaling, RiskManagement, TPRMPodcast, SecurityArchitecture, VendorRisk, DevSecOps, StartupSecurity, NateLee, JasonChan
More from The TPRM Podcast
What if some of the things we call “security best practices” aren't actually reducing risk?
AI is accelerating cyberattacks to machine speed. But most security programs were built for a world where attackers moved at human speed.
AI isn't just changing how we write software.
Most conversations about AI focus on one question:
Most conversations about AI and cybersecurity focus on a simple question: