Charlie Williams

FIELD 01 / PROFILE

AppSec · AI Security · Identity & Trust

I lead Product Security at Upside, with a background in Application Security and security engineering. I stay hands-on in architecture and engineering while managing the team, with current work spanning AppSec, authentication and account trust, AI security and enablement, and the data and automation behind those programs.

My work often starts with ambiguity: understanding the problem, gathering enough evidence to make a decision, and turning that into systems, controls, and workflows that hold up in practice. A recurring theme is the trust boundary: what people, services, or agents are allowed to do, and under what conditions. Those boundaries increasingly cut across traditional security domains and org charts.

FIELD 02 / CAPABILITIES

Product & Application Security

Secure architecture + threat modeling Code + software supply-chain security Developer guardrails + secure defaults

AI & Agent Security

MCP + agent trust boundaries Delegated authority + permissions Governance + observability

Security Platforms & Data

Policy-as-code + automation Security telemetry + data models Developer workflows + decision-grade metrics

Trust, Fraud & Abuse

Account trust + recovery Fraud + abuse signals Risk states + high-risk product controls

Identity & Authorization

Authentication + authorization Identity + access controls Delegated permissions + least privilege

FIELD 03 / EXPERIENCE

Upside

Manager, Product Security

– Present

Lead Product Security across AppSec, identity and authorization, AI security and enablement, and fraud/trust. Current work includes authentication and account-trust architecture, AI developer tooling and agent governance, and turning cross-system risk into concrete technical controls.

Manage and develop engineers and analysts, with domain leads taking on more recurring technical and operational responsibility across the team.

Upside

Staff Application Security Manager

–

Moved into a management role while continuing to ship AppSec, AI security, and developer tooling work. Shifted more recurring operations and day-to-day responsibility to other engineers and partner teams.

Upside

Staff Application Security Engineer

–

Promoted to Staff within nine months of joining Upside. Focused on the tooling, data, and developer enablement behind the AppSec function, including vulnerability workflows, CodeQL/CI controls, security data infrastructure, SBOM automation, and developer-owned remediation. Authored the security model and redesign for passwordless authentication and account trust.

Upside

Senior Application Security Engineer II

–

Joined as the second member of Product Security and helped establish and scale the AppSec function. Rolled out GitHub Advanced Security across 600+ repositories in a quarter, retired redundant tooling to cut annual costs by approximately $80K, and built reusable controls that new repositories inherited by default.

Booz Allen Hamilton

Lead Engineer

Application Security
–

Progressed to Lead Engineer on the U.S. Department of Veterans Affairs Software Assurance program. Performed 1,000+ secure code reviews across hundreds of applications and worked directly with development teams on exploitability, risk, and remediation. Helped expand the program into threat modeling, design review, software composition analysis, developer enablement, and security workflow automation.