Case Studies

The problems, decisions, and operating models behind my work in product security.

Open-source tooling

SecOps Dashboard

Built a self-hosted workflow for importing, investigating, and triaging security findings. Explore the product and try a sample workflow.

Product security

Established AppSec, cloud security, vulnerability management, and governance as the first dedicated security engineer at Licious.

DevSecOps

Integrated Semgrep and Trivy into CI/CD, tuned findings, and introduced enforcement based on confidence and risk.

Security product

Built an attack surface management product at Invia, from asset discovery and enrichment to prioritization and reporting.

Cloud security

Connected CSPM findings to IAM, network, and data access controls, then validated changes through traffic and logs.

Detection engineering

Compared AWS WAF coverage with OWASP CRS categories and evaluated proposed rules in count mode before enforcement.

Cloud security

Evaluated how exposure, permissions, and trust relationships could combine, then sequenced remediation by business impact.

Developer tooling

Added local checks for secrets, IaC configuration, and common code patterns, backed by independent CI enforcement.

Security operations

Defined scope, triage criteria, ownership, and remediation workflows to turn external reports into engineering action.

Governance

Mapped controls to accountable teams and repeatable evidence workflows across Engineering, IT, HR, and Finance.