Application Security · DevSecOps · Vulnerability Management
Security specialist focused on building secure software from the inside out — integrating security into every stage of the SDLC through SCA, SAST/DAST, threat modeling, and CI/CD hardening.
Especialista em segurança de aplicações com foco em DevSecOps — integrando segurança em todo o ciclo de desenvolvimento por meio de análise de composição de software, SAST/DAST, modelagem de ameaças e automação em pipelines CI/CD.
| Area | Tools & Standards |
|---|---|
| Application Security | OWASP Top 10, threat modeling, secure code review |
| SCA / SBOM | Grype, Syft, CycloneDX, SPDX |
| SAST / DAST | Static & dynamic analysis integrated into CI/CD |
| Vulnerability Management | CVE triage, CVSS v3/v4, EPSS scoring, remediation guidance |
| DevSecOps / CI-CD Security | Pipeline hardening, security gates, shift-left practices |
| Secure SDLC | Security requirements, design reviews, developer enablement |
End-to-end vulnerability assessment of OWASP Juice Shop using a full SCA workflow.
- Generated CycloneDX SBOM with Syft
- Scanned with Grype; triaged CVEs by CVSS severity and EPSS probability
- Produced a client-ready HTML + PDF report with interactive charts (donut severity, EPSS bar, stacked exposure)
Python Grype CycloneDX SBOM Vulnerability Reporting
Python (Flask · FastAPI) ████████████░░░░ 65%
Shell / Bash ████░░░░░░░░░░░░ 20%
YAML / CI config ███░░░░░░░░░░░░░ 15%
I'm available for consulting, contract work, and full-time roles in application security and DevSecOps (open to international / remote).
📍 São Paulo, BR · 🌐 Open to remote / international opportunities