Jon Zeolla
Certified InstructorFounder and CEO at Zenable
Specialities
Cloud Security, Artificial Intelligence

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsCloud Security, Artificial Intelligence

Jon Zeolla is a SANS Certified Instructor and Founder and CEO of Zenable. He teaches SEC545: GenAI and LLM Application Security and SEC540: Cloud Native Security and DevSecOps Automation, bringing real-world experience in AI safety, alignment, guardrails, and cloud-native security into the classroom. His work helps students connect modern security practices to developer and engineering workflows.
Outside the classroom, Jon spends his time building software factories where governance and observability come first. As the founder of Zenable, he leads the team in developing self-improving verifiers that maintain alignment between coding agents and evolving company requirements.
Jon got started in cybersecurity in the early 2000s and began working with AI and machine learning in 2015 at Carnegie Mellon, applying large-scale data analysis to improve security automations. That work led him to contribute to dozens of open-source projects and initiatives, aligned with his interest in using data and feedback to improve systems and automate repetitive work. In class, that shows up in labs on AI guardrails, AI alignment, and policy as code, tied to the decisions teams face at work.
Additionally, he serves as an Agentic AI Foundation (AAIF) Ambassador, helping engineers understand and adopt open protocols for agentic systems, including MCP and A2A, via anything from talks and hands-on workshops to running strategy sessions to help navigate tradeoffs.
Jon teaches by pushing students past labels and into how tools work, where they break down, and how they can be adapted. Students describe him as clear, respectful, thorough with questions, and deeply knowledgeable. Students leave Jon’s class with the knowledge and tools to evaluate AI and cloud-native risks, apply security guardrails in developer workflows, reason through tradeoffs, and build lower-friction paths to secure delivery. Outside work, Jon spends his time with his wife and two kids, mountain bikes through the Appalachian hills, and enjoys lifting weights to stay in shape.
Jon was clear and to the point, happy to answer questions and respectful.
Jon has taken significant time to thoroughly answer questions myself and other classmates have had that have really helped in our understanding. He reminds me a lot of John Strand from back in the day.
Instructor is fantastic. Extremely knowledgeable in the subject matter and has easily answered many complicated questions.
Here are upcoming opportunities to train with this expert instructor.
Explore content featuring this instructor’s insights and expertise.
This session focuses on AI coding guardrails: practical, developer-friendly controls that help teams adopt coding assistants with confidence while maintaining strong security, governance, and assurance.

Manual reviews simply can’t keep pace with AI-generated code. In Part 3, see how agentic AI integrates with GitHub and GitLab to analyze pull requests, deliver structured findings, and provide scalable, consistent code review before and after commit.

AI is transforming DevSecOps. In Part 1 of this series, learn how AI coding agents and MCP extend cloud-native security tooling, configuring DevSecOps tools, policies, and integrations through prompts with live demos of LLM-powered workflows.

Join SANS Instructors AJ Yawn and Zenable Founder/CEO Jon Zeolla as they introduce the core concepts of GRC Engineering and explore how Policy as Code can bridge the gap between regulatory demands and the flexibility required in cloud-native environments.

Traditional compliance and risk management techniques don’t scale in cloud-native environments—manual processes are now an anti-pattern for good security.

Part 3: Continuing the Cloud Security Flight Simulator series, join SEC540: Cloud Native Security and DevSecOps Automation instructor Jon Zeolla for a webcast on software supply chain security.

The Cloud is enabling businesses to quickly adopt and use technology in ways that we've never imagined before. Security teams need to find ways to keep up; automation is the solution.By using Policy as Code tools we can define and enforce security guardrails. This allows developers and cloud engineers to continue shipping features while bringing the confidence to everybody that security requirements are being met.

This is a 2 hour hands-on workshop. Is your company adopting containers but you haven’t had a chance to figure out the best way to secure them yet?

Review relevant educational resources made with contribution from this instructor.