GEICO Security Team

Security at GEICO

Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.

3 Intel Signals

How they approach application security

GEICO's AppSec philosophy is to 'Protect security, privacy and integrity of customer and associate data & systems'.
They focus on developer enablement by 'Providing a golden path for application construction and deployment' and having a 'best practice and frameworks team' that 'implements initial shared functionality and full SDLC including CI/CD'.
Their risk philosophy emphasizes validating application security 'against OWASP Top 10 threats'.
A stated goal is to 'work with the Application Security team to provide feedback and recommendations'.
Gaps include no explicit 'AppSec mission statement' beyond general cyber wording, and no explicit phrasing like 'developer-first' or 'security as an enabler' was found.

The team

GEICO's AppSec team structure is not fully public, though 'Cyber' is listed under tech.
Key public-facing leaders include Katie W. in Product Security, Rick Vadgama as 'Global CISO and Cybersecurity & IT Operations Leader', and Anthony Mangieri as 'Head of Security for GEICO Insurance'.
No public headcount for the AppSec team was found.
As of, at least one AppSec-focused job posting (Senior Manager, Offensive Security) was located.
Common skill patterns from job postings include 'penetration testing', 'OWASP Top 10', 'automated reporting/tracking of findings', and 'NIST, PCI DSS' compliance.
Gaps include no public charter or org chart showing whether AppSec is centralized or embedded, and many LinkedIn profile details are gated.

What they're working on

No public evidence was found for a Security Champions program at GEICO. 'Shift Left' practices are indicated by 'full SDLC including CI/CD' and 'Providing a golden path for application construction and deployment'. The vulnerability management process involves developing 'automated reporting/tracking of findings identified during testing activities, following up with remediation teams' and ensuring 'penetration testing activities are meeting security and business objectives ... establishing metrics & KPIs'. Secure SDLC artifacts include 'initial shared functionality and full SDLC including CI/CD'. Recent initiatives (last 6 months as of) include hiring for Offensive Security leadership and public LinkedIn activity from Product Security leader Katie W. Gaps include no public, detailed vulnerability intake-to-remediation SLAs or explicit ticketing tool references, and no public statement naming a bug bounty provider.