Career profile
Mat Steinlin
Chief Information Security Officer, Opti9
- Current role, per sources checked 30 April 2026
- 14 October 2026
Mat Steinlin is the Chief Information Security Officer of Opti9, appointed in October 2026 following the company's acquisition of Aptible.
Career path
Steinlin began his career as Co-Founder and CTO of dog-ibox.
He went on to hold information security leadership roles at Peerfit and Lifespark.
He later served as Chief Information Security Officer and VP of Security Engineering at RISCPoint.
In 2023 he became Head of Information Security at Aptible, leading security and compliance work for digital health companies through HIPAA, HITRUST, SOC 2 and PCI assessments.
Opti9 acquired Aptible, and Steinlin moved into Opti9's executive leadership team as Chief Information Security Officer.
He holds a bachelor's degree in Application Development and IT Security from WISS School of Business Informatics and is a Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM).
Remit at Opti9
As CISO, Steinlin leads Opti9's security strategy, with responsibility for keeping the company's growing hybrid cloud and managed services platform secure, compliant and resilient for customers across healthcare, finance and other regulated industries.
His work includes guiding customers through compliance frameworks such as HIPAA, HITRUST, SOC 2 and PCI.
"Security has to earn trust every single day, not just check a box," said Steinlin.
Published work
While Head of Information Security at Aptible, Steinlin wrote The Annual Pentest Is Dead: Here's What a Modern Security Program Looks Like Instead, published on the Aptible blog in April 2026.
In the piece, he described using an AI model to scan a codebase in two hours for twenty dollars, finding vulnerabilities that a recent penetration test had missed, and argued that the audit frameworks governing regulated industries were built for a model in which sophisticated attacks required sophisticated attackers.
He has written that he has led security assessments for digital health companies through HIPAA, HITRUST, SOC 2 and PCI compliance for over a decade.
