Mayhem Makers: Josh Thorngren, VP Marketing and Product

Debra Hopper
April 1, 2024
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

“Mayhem Makers” is a Q&A series dedicated to our growing company.

For this month’s profile, we talked with Josh Thorngren, VP Marketing and Product on the Mayhem team, who joined the company in September, 2022 and is based out of New York City.

Tell our readers a little bit about what your role entails. 

I know everyone says “my job has evolved over time”, but I promise you, it’s true! I joined with the mission to scale up our marketing function as we transitioned from selling in the federal space to a broader commercial motion.

Since then, my scope’s grown a bit—I’m responsible for the product organization as well. So I’m not just worried about how we generate new leads and revenue from a go-to-market perspective; I’m also focused on how we continue to deliver compelling value within Mayhem itself. I wake up every day asking myself how we can make Mayhem easier, more powerful, and more actionable for our customers. 

What did your career path look like before you came to work here?

After a few post-college years of freelance development and DevOps work, I ended up at a marketing agency, where after a brief stint on their DevOps team, I built out the agency’s marketing technology practice.

I spent another five years in the agency space, including helping to found and scale up a marketing technology agency through acquisition. After that, I moved over into working with companies directly in a marketing ops capacity, helping them implement technology and build scalable processes.

In 2016, I took my first marketing leadership role, and I’ve done some type of similar job ever since. I tend to focus on DevSecOps and DevOps areas, both due to my background and my strong opinions on the failures of “shift left”.

What is your typical day like?

I'm a big believer that having structure and routine really helps. I try my best to make my days as typical as possible and to plan time for the unplanned.

Where my day really starts, every single day, is with a recap of what's happened in the past 24 hours: What sales activities have happened? What customer tickets have been filed? What marketing activities have occurred? What customer prospect or partner communication has come in? What questions does our team have internally? 

That sort of upfront triage helps me figure out if my day is going to be spent working heads down or helping others get work done. I make the distinction there because we're still a small company, so my role as a leader is player and coach. There are things I have to do myself, and there are things that I assist others in doing. So that triage kind of sets that up.

After that, it's meetings, coordination, updating roadmap items, meeting with customers to understand feature requests, working with the marketing team on brand revisions—a lot of communication coordination.

What has been your favorite project you’ve worked on since joining the Mayhem team?

The thing I'm most excited about is something that will probably be hitting general availability around the time this interview comes out, which is Mayhem's dynamic SBOM and runtime profiling.

For context, what we hear from our customers a lot is that they love the fact that Mayhem’s results are actually real things to go fix. Another thing we hear from our customers and internal team is “You know what, every time we submit a new version of AWS Marketplace, we do a container scan, and there are 500 false positives in this SCA tool, and it's hard to write an explanation for every single one. You have to go through each one and say this is real, this isn't real, this is a false positive, etc.” Just today, we were reviewing a scan report, and the team's like, “ah, we have so many justifications. This is wrong. We don't even use these things. They’re not even on the attack surface.”

So the dynamic SBOM functionality basically uses Mayhem’s analysis engine to build a profile of your application’s attack surface and then marries that with your existing investments in SCA tools. It filters down those results to what's actually reachable, and then creates justifications for your team, like “After this observation period, we were unable to check this component on the attack surface. We're ignoring this CVE.” 

In our testing, it reduces about 60% of noise in under a minute. And, to me, that's transformational. And when I think about every dev team I've been on or worked with, this has always been a problem they've had that, honestly, I haven't seen solved yet. So I'm really excited about that coming out.

When you are at work, how do you motivate yourself or what helps you focus?

Big picture, I’m motivated by winning and money. I want the company to exceed revenue targets and beat the competition. That’s what gets me excited and focused.

Sometimes, it’s hard to carry that excitement into the day-to-day. So I rely on routine and process to keep me focused. I use a tool called Sunsama to help me with my triage and planning of my day. I’ve used it for over three years now, almost daily. 

I like it because it sets up a really intentional process where I have to think about my priorities for the day. I have to think about how much time I'm giving to each piece of work and really force myself to make a commitment on what I'm going to get done at the start of the day. And I’ve found that, more than anything else, that routine helps me stay motivated and focused.

How have you grown professionally while working here?

I've never run a product team before. 

I'm a big believer that internal functions should have effective communication with just the right amount of friction. You don't want to create unnecessary internal friction, but it's also essential to recognize that sales, marketing, and engineering each have their own perspectives, even though we're all working towards revenue as a goal.

So, while working here, I've delved deeper into understanding how the product function works, its needs, and its friction points. Taking on the product function and building it out has been a good experience for me. It's helped me, as a career-long marketer, understand some of the friction points I've experienced in the past.

Looking back at past marketing leadership roles I've had where I was challenged by our product leadership, I can see things I would do differently now that I've been on both sides of that coin. That's the biggest takeaway for me.

What has your experience been with our company culture?‍‍

Small digression. I’d never been to Pittsburgh before this job. It might be my favorite city in the US. I’m a vaguely reformed crust punk kid, and Pittsburgh fits with that vibe perfectly, and it has trees and nature everywhere. 

Back to our company culture: One thing that continues to surprise me here is the level of thought that goes into decision-making. A lot of startups break into jail by not asking “what should we do?” or “how should we do it?” before running ahead with execution. This creates friction and confusion, which ultimately hurts the business. 

We, more than any other startup I've been at, don't have that problem. There's a lot of intentionality in every decision. Now, being fair—leaning too far in that direction comes with its own set of problems. You have to avoid analysis paralysis, but on the whole it’s a positive difference. 

What advice can you offer to someone looking to get into a role like yours?

The best advice I can give is some of the best advice I’ve ever been given. Earlier in my career, I tended to think about things as “I agree, I don’t disagree, I disagree”. 

That hurt my growth as a leader in many ways. 

So more than “here's how to get into marketing” or “here's how to get into product”, the advice I give is to be intentional about what you say yes to and what you say no to, because both carry equal weight. The best advice I ever received in my career, though it took me ages to actually listen to and internalize it, was that there's a huge distinction between agreeing, not disagreeing, and actually disagreeing.

A lot of times, people avoid disagreeing because they don't want to have conflict. But not disagreeing is actually an active stance. And so, my advice is just to be intentional. Like, do you agree, do you disagree, or do you not have an opinion? And I think that, more than anything else, this is why I continue to choose the roles I do. I think I've learned the art of knowing what to be opinionated about and how to communicate that.

Tell us about yourself outside of work. What are your hobbies?

When I need to relax, I typically cook a good meal, or put some headphones in and hop on a bus or train for a few hours with no destination in mind. I’m not much for ongoing hobbies - I’m a serial project person. Find the perfect backpack, build a patio deck, rewire the outlets in my office, learn to sew my dog’s toys back together. 

My days are pretty routine in structure, even if the specifics vary a lot. My wife (who’s awesome) and I typically catch up in the mornings before work or chores. She’s a product leader and put the time in with me when I started that role to mentor me and help me avoid rookie mistakes. Then it’s adventure time—my dog and I go for a jog, run around in the park, climb on things, or sometimes just sit on a stoop or bench and hang out. 

The rest of the day is usually built around tasks, usually Mayhem-related on weekdays, usually family and home-related on weekends. I plan every day the same way though, because the routine is good. Maybe planning is my hobby?

What is something you’ve learned in the previous month, whether connected to your job or not?

This is a hard question to answer. If I’m not learning something every day, I’m doing something wrong. It can be a new way to communicate, fine-tuning of my work style, an interesting fact, or a new skill. I’m not trying to be stubborn by not giving an answer, but I feel like learning is the default. We have to always be learning and improving. 

What is something unique about you (a fun fact) that few people know about?

If you’ve met me in person you would say I have no problem with talking. I talk…a lot. Here’s the thing though—in elementary school I was in the bottom 3% of students in the United States for verbal skills. I struggled to produce the correct sounds to form most words, and spent another decade in speech therapy. I’m thankful for that, though I’m not sure the folks who have ever shared a co-working space with me are.

Share this post

Add a Little Mayhem to Your Inbox

Subscribe to our weekly newsletter for expert insights and news on DevSecOps topics, plus Mayhem tips and tutorials.

By subscribing, you're agreeing to our website terms and privacy policy.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Add Mayhem to Your DevSecOps for Free.

Get a full-featured 30 day free trial.

Complete API Security in 5 Minutes

Get started with Mayhem today for fast, comprehensive, API security. 

Get Mayhem

Maximize Code Coverage in Minutes

Mayhem is an award-winning AI that autonomously finds new exploitable bugs and improves your test suites.

Get Mayhem