I'm a Computer Engineer with a background in penetration testing, currently specializing in DevSecOps — building automated security pipelines that embed security directly into the software delivery process.

• ✅ CI/CD security pipelines with GitHub Actions
• ✅ SAST automation with Semgrep & CodeQL
• ✅ DAST scanning with ZAP by Checkmarx on AWS
• ✅ Software Supply Chain Security with Dependabot & Dependency Review
• ✅ SBOM generation with CycloneDX & osv-scanner
• ✅ Branch protection, CODEOWNERS & repository security controls
• ✅ Infrastructure as Code with Terraform

• 🎓 DevSecOps Pro — Mission InfoSec Academy (June 2026) • 11 CPE Hours
• 🏗️ Terraform — KodeKloud (June 2026) • View Certificate
• 🌐 Cisco Certified — Networking Fundamentals

A fully automated security pipeline built on a deliberately vulnerable Python application, demonstrating real-world DevSecOps controls from SAST to SBOM generation on AWS.

View Repository

Security controls implemented:

• 🔴 SAST: 199 code scanning findings identified by CodeQL (Code Injection, SSRF, Uncontrolled Command Line)
• 🔴 DAST: 16 alerts detected by ZAP baseline scan on live AWS deployment
• 🔴 SBOM: 100 known vulnerabilities across 34 packages — 99 with available fixes
• 🟡 OpenSSF Scorecard improved from 2.6 → 2.8 after implementing branch protection
• ✅ Branch protection + CODEOWNERS enforcing secure code review on every PR
• ✅ Dependency Review blocking vulnerable packages at PR level (caught GitPython 3.1.29 — Critical)
• ✅ Dynamic AWS Security Group IP allow-listing for secure GitHub Actions runner access

I document my DevSecOps learning publicly on LinkedIn — lab screenshots, lessons learned, and real pipeline builds.

Connect on LinkedIn

Open to DevSecOps internship and entry-level opportunities. Feel free to connect on LinkedIn or explore my repositories!