Services · DevSecOps & Security
Beyond building products, I help teams set up a DevSecOps environment and work through application, cloud and AI security. The output is not a report — it is a pipeline, cluster and permission model your team can keep running.
From commit to production · a gate at every step
Service 01 · DevSecOps
Security is not a check before release; it is a default action across commit, build, deploy and run. The goal is a process the team can maintain — not a set of tools only the consultant knows how to use.
Start with repositories, branching, CI/CD, registries, Kubernetes and the release process. Problems are sorted into "already doing", "missing" and "only on paper", then turned into a risk-ranked roadmap delivered in stages. No tool shopping first.
Add SAST, SCA, secret scanning and image scanning to your existing CI — GitLab CI, GitHub Actions or Jenkins. Gates separate blocking from advisory: new issues block, existing ones get a deadline, instead of a wall of red on day one.
Generate and archive SBOMs, pin dependencies and base images, sign and verify images with cosign, and isolate build environments and registries. "Where did this image come from, and what built it?" becomes a question with an answer.
Manage environments with Terraform, Helm and Kustomize; scan IaC with Checkov / tfsec; enforce policy as code with OPA / Gatekeeper / Kyverno. Environment differences live in code, not in someone's memory.
Least-privilege RBAC, NetworkPolicy segmentation, Pod Security Standards, external secrets (External Secrets / Vault), admission control and Falco runtime detection. The cluster goes from "it runs" to "we know who is running what".
Set SLAs for vulnerability fixes; instrument gate pass rates and mean time to remediation; write an on-call runbook and rehearse a failure and rollback. Repositories, documentation and access are handed over together.
Weekly steps, each one a place you can stop. No big-bang rewrite of the existing process, and no risk deferred to the last day.
Interviews plus a hands-on review of repositories, pipelines, images, the cluster and releases. Output: current state, risk list and agreed scope.
Pipeline, scanning, gates, IaC and cluster baseline land one by one. Every change is reversible and starts small before it is rolled out.
Pick one real service and run it from commit to production end to end. Fix blocking issues and confirm the gates do not stall normal delivery.
Documentation, access and rehearsal records, plus a 30-day question window. Ongoing support on demand; no resident consulting.
Three things from your side: read access to repositories and CI, a non-production cluster or namespace, and one person who can make decisions. The clearer the time window, the more specific the plan.
If there is no Kubernetes yet, start with CI and the image supply chain. If there is no automated build yet, fix that first — DevSecOps gates need somewhere to attach.
No tool licences sold, no vendor lock-in. We use the CI, cloud and open-source components you already have and fill the gaps. If a commercial product is genuinely needed, you get the reasoning and an exit plan.
Service 02 · Security
These three tend to show up together: permissions and data in the application, identity and network in the cloud, and new boundaries around AI features. Take one, or review all three in one pass.
From design to code, find what can actually be exploited — and how to fix it.
Tighten cloud defaults to match business risk — not switch everything off.
Before an LLM feature ships, be clear about prompts, data boundaries and tool permissions.
How we work together
A one-off review, or a focused engagement around a launch or a quarter. Scope is written down before work starts.
One system or one launch: architecture, code, configuration and cloud in a single pass. Output is a risk-ranked issue list with reproduction steps and fixes, plus a review meeting.
One clear goal — pass a customer security questionnaire, harden Kubernetes before launch, ship an LLM feature safely. Includes design, implementation and retest, not just advice.
Fixed time each month for design review, pre-launch checks and questions. Not a full-time hire, but continuous — security fails where nobody keeps watching.
How I work
There is no universal security template. The same gate has very different costs and benefits in a ten-person team and a regulated enterprise.
So every engagement starts from the current state: what needs protecting, how much friction is acceptable, and only then which gates to add. Better one layer fewer than a control nobody maintains.
Start from logs, permissions and the real delivery path — not a checklist applied to every team.
Integrate existing CI, cloud and open-source components. No vendor lock-in, no licence sales.
Docs, rehearsal and access handover. Done means the process survives the consultant leaving.
Next step
