Nir Valtman

Information Security Executive. Public Speaker. Vlogger.

My official profile Bio

Nir heads the product & data security for Finastra. Beforehand, he was the CISO at Kabbage and worked at NCR in several roles, including heading the application security across the software solutions portfolio and leading the divisional information security group as the Retail CISO. Furthermore, as part of his previous positions, he was working in several security leadership, application security, penetration testing and systems infrastructure security positions.
Nir is a frequent speaker at leading conferences around the world, including Black Hat, Defcon, RSA, BSides, and OWASP.
Nir has a Bachelor of Science in Computer Science but his knowledge is mainly based on cowboy learning and information sharing with the techno-oriented communities.

A Virtual Reality (VR) system and method are provided that integrates transaction processing. A VR session customer transaction information is obtained and a transaction is concluded with the transaction information during the VR session.
A request for access to a user's account is made to an authenticator. The authenticator sends a request for access to the user associated with the user's account. In response to user authorization, the authenticator sends an access link to a service engineer. The service engineer access the link to access the user's account with limited and restricted access. When a remote service session associated with the activated access link is terminated, the authenticator sends a termination of session notice to the user.
A user identifier to a user is received over a messaging platform. The user identifier is mapped to a user identity that includes an identity mapping to a plurality of other user identifiers for the user that are used over other messaging platforms by the user.
A user is initially registered during a session with a messaging platform through an out-of-band registration communication. When a user attempts to make a payment within the session or within subsequent sessions with the messaging platform or subsequent sessions with different messaging platforms, the user is presented token names representing registered forms of payment within the user's session. The selected token name is mapped outside the session to specific registered payment details and the payment processing is processed on behalf of the user during the session but through out-of-band session communications. Confirmation of payment is then sent back to the user in a session communication.
A user is initially trained for voice authentication within a messaging platform session. After training and during the same session or a different session with the messaging platform session or with a different messaging platform, and when the user requests during such session a sensitive operation be performed on behalf of the user with an external service, a randomly generated voice challenge is delivered to the user during that session. If a returned voice recording from the user is authenticated in response to the issued voice challenge, then the sensitive operation is performed on behalf of the user during the session.
A user is assigned an initial risk score during a session with a messaging platform. During the session, the user attempts an operation with an external service. One or more additional authentication factors are requested from the user to dynamically lower the initial risk score. The lowered risk score is processed with the external service to perform the operation on behalf of the user during the session.
An Operating System (OS) command launcher or loader is newly obfuscated each time a command is successfully processed by the OS command launcher. Moreover, a binary for the OS command launcher is validated each time a command is attempted to be processed for execution by the OS command launcher.


CISOs are in sales because of him.


Contact Information

Feel free to drop me a line at nir
You can also reach out via or .
My PGP is here.


Detailed Info

My resume is availabe here.

  • Participated in the panel on the topic "Forward-Thinking Perspective".

  • Presented the lessons learned on how to scale an information security program at a startup and the delicate balance of building a diligent foundation without stifling innovation and growth.

  • Participated in a pannel discussion related to how GDPR changed the business and privacy globally.

    September 17

    Keynoted about Container Security (101 level)

  • Hacker Halted
    September 14

    Deep tehnical dive to container security.

  • DevSecCon Boston
    September 11

    Presented a technical talk about how to attack and defend containerized solutions.

  • Represented the FinTech security aspects in a pannel discussion.

  • Executive level presentation on how to scale application security in a diverse engineering organization.

  • Presented my jorney to secure 100 products.

  • Presented how to scale application security.

  • Presented the attacks and defenses in the Retail industry.

  • Trained the audience on how to mature the application security practices.

  • Demonstrated how to bypass the security mechanisms provided by the payment points of interaction, e.g. PinPads. The summary of this talk was covered on 30+ languages.

  • Demonstrated how to bypass the security mechanisms provided by the payment points of interaction.

  • ToorCon
    October 24

    Technical deep dive into security orchestration an automation on Amazon Web Services.

  • Defcon
    August 8 | Video

    Presented how to orchestrate and automate security on Amazon Web Services within a few minutes.

  • Introduced an open source tool to orchestrate and automate security on Amazon Web Services.

  • Defcon
    August 8 | Video

    Presented my research about Bug Bounty Programs.

  • Defcon
    August 7 | Video

    Showcased how point of sale (POS) attacks can be executed and provided thoughts on how to cope with them.

  • Presented how to attack and defend points of sale.