Case study
Building Product Security from Scratch
As Licious’s first dedicated security engineer, I established a shared operating model for application security, cloud controls, vulnerability management, and governance.
Licious · SDE-3, Product Security · May 2025–Present
On this page
The starting point
A growing consumer product needed security ownership across web, mobile, APIs, and AWS. The mandate included technical controls and the processes that turn findings into fixes: a defined scope, severity criteria, service owners, remediation expectations, and escalation paths.
I owned the security function and worked with application, platform, and leadership teams to put those pieces into day-to-day engineering workflows.
The operating model
- Find and validateCombine code, dependency, cloud, and researcher findings. Confirm reachability and impact.
- Prioritize and assignRecord the affected service, severity, business context, accountable owner, and fix expectation.
- Remediate and verifyWork with engineering on the change, then retest the original condition.
- Prevent recurrenceFeed recurring patterns into rules, architecture reviews, developer guidance, and control evidence.
Controls and delivery
| Area | My contribution | Supporting case study |
|---|---|---|
| Secure delivery | Integrated Semgrep and Trivy into CI/CD and tuned custom rules | Pipeline security |
| Developer feedback | Added local checks for secrets, IaC, and common code patterns | Pre-commit hooks |
| AWS posture | Validated CSPM findings and reviewed IAM, network, and data access | Cloud posture |
| Edge controls | Compared WAF coverage and evaluated rules before blocking | WAF coverage |
| External research | Defined scope, triage, researcher communication, and remediation handoffs | Bug bounty operations |
| Governance | Coordinated control ownership and evidence across Engineering, IT, HR, and Finance | ISO 27001 readiness |
Decisions that shaped the program
Give every finding an owner. I consolidated SAST, SCA, container, cloud, and bug bounty findings into a common vulnerability matrix. Resource, severity, business impact, owner, SLA, and status made it possible to follow work across tools.
Validate before enforcement. New checks and controls needed evidence that they detected the intended condition and worked with legitimate application behavior. WAF rules were evaluated in count mode before promotion to blocking.
Use context when prioritizing. Exploitability and exposure on login, checkout, and payment surfaces shaped sequencing. Raw scanner severity was an input to that decision.
Outcomes
The security function gained defined ownership, a repeatable finding lifecycle, and shared engineering controls. CI/CD integration and custom rule tuning contributed to an approximately 30% reduction in critical production-bound vulnerabilities.
The detailed DevSecOps case study explains the controls and trade-offs behind that result. The résumé provides the wider role and employment history.