Avi Douglen

Outreach is key.  

We've been doing quite a bit of outreach, especially lately - joining developer conferences, hosting a table at Black Hat, and especially the Outreach and Education committees. Of course, there is always more to do, and there are a lot of productive directions to take. 

I would continue to encourage and grow this outreach, and leverage our extensive community of experts to participate in events outside our typical bubble. Such as developer conferences, hacker meetups, CISO events, and more. Moreover, taking leadership positions at these events and in other community organizations will have incredible impact, and I will move to support these efforts and increase investment in our presence in other communities. 

Since the creation of the Chapters Committee, we've moved to reverse this trend. We've put roadblocks in the dispanding process (as part of the refreshed Chapters Policy), to ensure we can get involved and reinforce struggling communities. We've continued to support all chapters to avoid getting to that situation in the first place, and helped other chapters continue to grow and thrive.    

I've also introduced a new model for [Regional Chapters](https://groups.google.com/a/owasp.org/g/leaders/c/jw60vATKKpU/m/Al8K6ph8BwAJ), which is currently in process leading up to official Board approval. This new addendum to the Chapters Policy is designed for non-typical City Chapters, and allow for wider regional communities to host a collective chapter. In particular, this model also defines a model for Chapter Branches, which will be a great solution for smaller, remote locations that cannot host a full Chapter but still want to have some local OWASP activity. 

I do not have any particular experience serving on the board of a large international organization.  

However, I do have experience serving on OWASP's Chapters Committee, as the Vice Chair. I've also been involved in organizing multiple global conferences, spending months working with the rest of the team and recruiting volunteers. I am also on the Board of Advisors for a couple of international companies, including a startup incubator. I have volunteered for over a decade as a moderator on StackExchange's Security site, growing it into a vibrant, productive community that has become a vital resource for thousands of professionals.  

I do also have quite a bit of professional experience working with global teams, and their leadership, aligning incentives and getting everyone moving in the same direction, building strategy, and designing financial plans to support organizational objectives. 

IMO this is a hard question. To be fair, our earning sources had been faltering even before COVID-19, I've had conversations years ago with staff about revising how we host our conferences. Of course with the pandemic stopping (almost) all in-person events for the forseeable future, we are forced to consider other options. 
While we've had some pretty successful virtual / remote events, as well as trainings, it is clear this is not enough to sustain the organization as a whole. We need to ramp up our corporate supporters, as well as find new sources of income. In order to achieve this, we will need to study our options, consider what we can offer companies (without violating our core principles such as vendor independence of course), and get creative. We absolutely can find these creative solutions, but it won't be simple. 

Overall I think OWASP is already changing in good directions. In particular, I do think the following issues need be improved: 

1. Diversity and inclusion - we have a great WIA committee, and they already do a lot. However, IMO we are still nowhere near where we need to be, and not just _women_ in appsec. We need to increase our efforts in this area, including both recruiting more diverse community members, and retaining more of them over time. We especially need to continue to grow their presence, so that OWASP leadership is even more representative of all people in our industry. 
2. Independence and vendor agnosticsm - as a core OWASP value, it is incredibly important that we are perceived as an independent source of the best way to do appsec, and not influenced or poisoned by commercial interests. Both at a corporate level, and a personal level - and this applies to events, projects, chapter activities, and more. 
3. Corporate funding - I believe the majority of OWASP funding should be the corporate vendors that participate in OWASP, and the companies that benefit from the projects we create. Volunteers should not be reaching in to their own pockets to initiate or sustain OWASP activity, but we need to increasingly look towards our corporate supporters to fund as much of our ongoing activities as possible. 

To be perfectly honest, I have idea what our industry will look like in 10 years, no one does (except maybe futurists). 

Clearly, the bifurcation of appsec jobs will continue, with high-end analyst and strategic positions moving even higher upstream, and the majority of the "lower" engineering positions specializing even more on a wider range of niche topics and tasks. 

However, I do have ideas of what we should be doing towards supporting whatever that future is. We do need to be involved in defining proper software development, whatever that will look like in the future. We need to be providing relevant, modern tools to secure whatever form our development environment, technologies, and pipelines will take. And we need to be supporting all of the roles in AppSec (as well as adjacent jobs), no matter what tasks they will be required to be doing.