DevSecOps specialist, who focuses on Software Supply Chain Security
Defensive security background. I build pipelines that prove what they ship.
I work on software supply chain security: how to know that an artifact was built by the pipeline you trust, from the source you reviewed, with dependencies you can account for.
My approach is hands-on. I build a control, then deliberately attack it, because reading about a mitigation is not the same as watching it fail under real conditions. My foundation is defensive security: I trained in threat hunting, incident response, and detection engineering (MITRE ATT&CK, Elastic SIEM) through hands-on SOC labs, so I don't only implement controls; I think like the attacker they are meant to stop.
Cosign/Sigstore Syft Grype Trivy Kyverno ArgoCD Trivy Operator GitHub Actions
- Pipeline: automated CI/CD flow (Lint → Trivy → Cosign sign → SBOM → attest), migrated to fully keyless signing via GitHub Actions OIDC, eliminating long-lived private keys.
- Remediation: reduced CRITICAL Trivy findings from 3 to 0 by removing root causes instead of suppressing alerts; documented 2 CVEs with EPSS 99.99% as not affected via VEX.
- Triage: Python script for batch vulnerability prioritization using the EPSS API, ranking by exploitation probability rather than static CVSS.
- Admission control: Kyverno
verifyImagespolicy tied to a specific GitHub OIDC identity, blocking unsigned deployments before Pod creation. - GitOps & runtime: ArgoCD + Kyverno, with documented
Sync: Failedcases showing that GitOps status alone does not guarantee workload security; Trivy Operator for runtime drift detection.
slsa-github-generator slsa-verifier Cosign GitHub Actions GHCR
- Attestation: SLSA Build Level 3 provenance generated by a pinned reusable workflow (
slsa-github-generator) running as a separate job under its own OIDC identity; verified withslsa-verifieragainst the expected source repository and branch. - Attack simulation: simulated stolen registry credentials by pushing an image to GHCR outside the pipeline;
slsa-verifierrejected the digest because no attestation was attached to it. - Forged provenance experiment: edited the source repo and commit in a decoded copy of the provenance and passed it via
--provenance-path.verify-imagereturned PASSED, and returned the same result for/dev/null. Concluded that this is not a bypass: the file's content did not affect the verdict in this setup, and my test never exercised the signature check. - Not tested / open: negative controls with a wrong
--source-urior--source-branch; the root cause of the flag's behavior (code and issue tracker not reviewed); other builders; verifier version was not recorded.
Nexus Repository OSS npm pip Docker Compose
- Setup: self-hosted Nexus Repository OSS 3.68 lab (Docker Compose, REST API provisioning script) with npm and PyPI group repositories, each merging an internal hosted repository and a hosted repository standing in for a public registry.
- Experiment: with a same-name, higher-version package in the simulated public repository, the group listed both versions and npm installed the higher one. Documented that the group merges metadata and the client resolver picks the version. No proxy to a real external registry was involved.
- Mitigations tested: npm scoped package with scope-to-registry mapping in
.npmrc, and pip with a single--index-url; both installed the internal package. The vulnerable pip run was not recorded. - Not tested / corrected: lockfiles,
--ignore-scripts, routing rules on a proxy. Initially misread the absence of routing-rule effects in a hosted-only group as a finding; corrected after checking Sonatype's documentation (routing rules apply to proxy repositories only).
| Area | Tools |
|---|---|
| Supply Chain Security | Cosign (Keyless OIDC), Sigstore, SLSA Provenance, SBOM (Syft, CycloneDX), Grype, VEX, Nexus Repository OSS |
| DevSecOps & CI/CD | GitHub Actions, ArgoCD (GitOps), Shift-Left Security Gates, SAST (Bandit), SCA (Trivy), DAST (OWASP ZAP), Secret Detection (Gitleaks) |
| Kubernetes Security | kubectl, Helm, RBAC (Least-Privilege), NetworkPolicy (Zero Trust), Kyverno (Policy-as-Code), Trivy Operator, securityContext |
| Infrastructure & IaC | Terraform (Modules, Workspaces, Remote State), Terragrunt, Ansible, Packer, AWS, Yandex Cloud |
| Containers & OS | Docker (Multi-stage, Non-root), Linux (Ubuntu/Debian), Linux Hardening (Auditd, Fail2Ban, UFW), Nginx, Windows Server |
| Monitoring & SIEM | ELK Stack, Splunk, Wazuh, Prometheus + Grafana, Loki, Sysmon, Velociraptor, TheHive, Cortex SOAR |
| Scripting & Network | Python (Pandas), Bash, Wireshark, Tcpdump, Snort IDS, NGFW |
Kubernetes Security & Cluster Hardening
kind kubectl Trivy Kyverno NetworkPolicy RBAC securityContext Helm
- Reduced Trivy findings from 17 to 7 (LOW only) with
runAsNonRoot,readOnlyRootFilesystem, andseccompProfile. - Identified a wildcard ClusterRole vulnerability invisible to standard
kubectl(flagged as 2x CRITICAL by Trivy) and enforced 7 Kyverno admission policies in Enforce mode. - Implemented deny-all-first NetworkPolicy; found and mitigated DNS-leak and
hostNetwork: truebypasses at the Kyverno admission level.
IaC DevSecOps Pipeline
Ansible Prometheus Grafana Docker GitHub Actions Trivy Bandit Gitleaks Auditd
- Docker Compose environment with Redis isolated in internal bridge networks, no exposed host ports.
- Node Exporter via idempotent Ansible playbook under Systemd; Prometheus + Grafana stack; Bash baseline hardening (SSH key-only, sudo restrictions, UFW default deny).
- Multi-stage pipeline with blocking gates for secrets, SAST, linting, and HIGH/CRITICAL vulnerabilities; non-root UIDs and Auditd integrity rules.
DevSecOps Pipeline: OWASP Juice Shop
Trivy OWASP ZAP NGINX GitHub Actions CycloneDX
- Detected 63 CVEs via Trivy and generated a CycloneDX SBOM; found hardcoded RSA keys and JWTs in Docker layers that source-only SAST missed; confirmed SQLi and Stored XSS with ZAP.
- Mitigated CORS, CSP, and X-Frame-Options issues at the Nginx reverse-proxy layer without changing application code.
Terraform Deep Dive & Production Patterns
Terraform Terragrunt Yandex Cloud GitHub Actions
- Zero Trust network: private subnets with egress-only NAT routing, highly available L7 load balancer across 2 AZs, least-privilege Security Groups.
- "Plan-on-PR" pipeline with dry-runs in PR comments and OIDC auth (no static keys); pre-deploy gates (TFLint, Trivy IaC) blocking open admin ports.
SOC & Detection Hands-On Labs (Background)
Velociraptor TheHive Cortex SOAR Elastic SIEM MITRE ATT&CK Python
- Hands-on end-to-end incident investigations with automated response and NIST/SANS-aligned reporting.
- Python tools for Nginx/Apache log parsing using Shannon entropy and GeoIP for attack risk assessment.
- Multi-stage attack hunting in hybrid infrastructure with Elastic SIEM (KQL); 5 correlation rules for brute-force, SMB access, and C2 traffic.
- Developing Secure Software (LFD121), The Linux Foundation, Oct 2026
- SEC1 Certification, TryHackMe, Feb 2026 (valid until Feb 2029)
Deepening my work in software supply chain security: build integrity, provenance verification, and admission-time enforcement.
Open to DevSecOps / Security Engineering roles where secure by default is a design goal, not an afterthought.
Reach me on LinkedIn