- Program Committee Member of the Third IEEE International Conference on Secure Software Integration and Reliability Improvement (SSIRI 2009), Shangai, China, July 2009.
- ACM Research Student Competition and Poster Chair of the ACM SIGPLAN 2009 Conference on Programming Languages Design and Implementation (PLDI 2009), Ireland, June 2009.
- Program Committee Member of the Fourth Workshop on Programming Languages and Analysis for Security (PLAS 2009), sponsored by ACM SIGPLAN and co-located with the ACM SIGPLAN 2009 Conference on Programming Languages Design and Implementation (PLDI 2009), Ireland, June 2009.
- Program Committee Member of the Network and Distributed System Security (NDSS 2009) Symposium, sponsored by the Internet Society, San Diego, CA, USA, February 2009.
- Program Committee Member of the 24th Annual Computer Security Applications Conference (ACSAC 2008), sponsored by Applied Computer Security Associates (ACSA), Anaheim, CA, USA, December 2008.
- Program Co-Chair of the Third Workshop on Programming Languages and Analysis for Security (PLAS 2008), sponsored by ACM SIGPLAN and co-located with the ACM SIGPLAN 2008 Programming Language Design and Implementation (PLDI 2008) conference.
- Program Committee Member of the Bytecode 2008 workshop, co-located with the European Joint Conference on Theory and Practice of Software (ETAPS 2008), Budapest, Hungary, March-April 2008.
- Program Committee Member of the Programming Language and Analysis for Security (PLAS 2007) workshop, sponsored by ACM SIGPLAN and co-located with the ACM SIGPLAN 2007 Programming Language Design and Implementation (PLDI 2007) conference as part of the 2007 Federated Computing Research Conference (CFRC 2007).
- Program Co-Chair of the Program Analysis for Security and Safety Workshop Discussion (PASSWORD 2006) workshop, co-located with the 20th European Conference on Object-Oriented Programming (ECOOP 2006), Nantes, France, July 2006.
Furthermore, Marco Pistoia has been associate reviewer for conferences POPL, PLDI, ISSTA, ICSE, FSE, SPAA and OOPS, and for journals TOPLAS, TISSEC, TSE and IBM Systems Journal.